b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:16

Target

b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll
Size

44KB
MD5

92e304a724595dd57693c8238a43ba80
SHA1

9e45e43e410c3446bb1a539f2f78a811691f124a
SHA256

b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b
SHA512

a487332829a56e4b538bf421baeafb684004d573bc0040db20553f1f88afd6d4c51bb5f71ae2eae1f9b74df816279474eb6edd9a63bc44c7921e2e865f7aa945
SSDEEP

768:oQwCRpkavotlQnPcxRmvSyipAegLa1qH:oQKGkkvS47Lao

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 4248	3732	regsvr32.exe	81
PID 3732 wrote to memory of 4248	3732	regsvr32.exe	81
PID 3732 wrote to memory of 4248	3732	regsvr32.exe	81
PID 4248 wrote to memory of 2116	4248	regsvr32.exe	83
PID 4248 wrote to memory of 2116	4248	regsvr32.exe	83
PID 4248 wrote to memory of 2116	4248	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2116