c2d7bd36651438dc46e8519dcaccff7fbbe838ee3e9b7f875893c7cf9a3493a1

Analysis

max time kernel
45s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 00:59

Target

hxsyfzgj_56086/YY幻想神域辅助0804/San.dll
Size

342KB
MD5

f1f2c76f4a836358c495bff6b2f30e45
SHA1

b51695087916bdefb895d3fa1e0eb1ad7dc96fa1
SHA256

d317f7595a9d94299751fe8207ba5520e43f57a4dcfada585577dea388a14a9a
SHA512

2e33c3f719f959141eabe7758e0235928292fe5b747f73ed84372bc26659a9e6f2dbdbb806ef8ac786028157d7d52b72cc0a0e0af613c10fbba88e7bf01380e1
SSDEEP

6144:8/v6GQaSb5ywXlpdoSUUzGJ3vbBUZKbCVFENvrae7vZ/bTGPaeE:ov0a85rXlsSzM6IvOe7vZzTrJ

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\360.log	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\San.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\San.dll
  2⤵
  - Drops file in System32 directory
  PID:840

memory/840-56-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download