04d1ffad25e9541cf1c0d2a054aba4b2cd2ca03c764cbf62bf8900cb92a38221

Analysis

max time kernel
68s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 07:12

Target

TheWorldPortable/Application/6.2.0.128/gcswf32.dll
Size

16.1MB
MD5

63f8c13f269b10bc9363b007daaacae6
SHA1

ed4abd417c9847395fd2c6218361d0ae7a52e63b
SHA256

33a012d73bc9ebff29ff488058a7e6d9a94e88c4c028094d1efcbec7d94875e9
SHA512

b0b11260722e998446851a9c2339dd6c9c48b8e6b9bb6ab980e4cafc32c5495ffb2a54be00832872701e86e968219178b4edfd920dc09e814d7c985858351edf
SSDEEP

393216:XpLKmMSqUNuimtPeEnSi5S+ceSlgk0ASKu/Bxx:XpLKmIUNutN0+c/8AjupX

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
924	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 924	480	regsvr32.exe	28
PID 480 wrote to memory of 924	480	regsvr32.exe	28
PID 480 wrote to memory of 924	480	regsvr32.exe	28
PID 480 wrote to memory of 924	480	regsvr32.exe	28
PID 480 wrote to memory of 924	480	regsvr32.exe	28
PID 480 wrote to memory of 924	480	regsvr32.exe	28
PID 480 wrote to memory of 924	480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\gcswf32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\gcswf32.dll
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:924

memory/480-54-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Filesize
8KB

Download
memory/924-56-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download