8a4bb2e889faece00d82f736824a204f210a25e18609f5074d92c9d86334d875

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:33

Target

8a4bb2e889faece00d82f736824a204f210a25e18609f5074d92c9d86334d875.dll
Size

48KB
MD5

5dd3e483368780a8734f0201736b7e31
SHA1

797022e68f630aa273559d9aed6d5e655118b7d5
SHA256

8a4bb2e889faece00d82f736824a204f210a25e18609f5074d92c9d86334d875
SHA512

a631d38df12efc884baeae76ffe55f5a6a5731953c027a8eba965461cb3ae44ef04a31ca8746c13b6afc4d3702d6ff8dc3cc48c8d1f9209b794f15755adaa68c
SSDEEP

768:J6+l7nZHCqi+g0O1XobnlSxqQN7nv6eehePyIxpIWC5bD0c+V:J6+l7opl1YblSUA7nv3eGxphgr+V

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1452	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1324	368	regsvr32.exe	26
PID 368 wrote to memory of 1324	368	regsvr32.exe	26
PID 368 wrote to memory of 1324	368	regsvr32.exe	26
PID 368 wrote to memory of 1324	368	regsvr32.exe	26
PID 368 wrote to memory of 1324	368	regsvr32.exe	26
PID 368 wrote to memory of 1324	368	regsvr32.exe	26
PID 368 wrote to memory of 1324	368	regsvr32.exe	26
PID 1324 wrote to memory of 1452	1324	regsvr32.exe	27
PID 1324 wrote to memory of 1452	1324	regsvr32.exe	27
PID 1324 wrote to memory of 1452	1324	regsvr32.exe	27
PID 1324 wrote to memory of 1452	1324	regsvr32.exe	27
PID 1324 wrote to memory of 1452	1324	regsvr32.exe	27
PID 1324 wrote to memory of 1452	1324	regsvr32.exe	27
PID 1324 wrote to memory of 1452	1324	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8a4bb2e889faece00d82f736824a204f210a25e18609f5074d92c9d86334d875.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8a4bb2e889faece00d82f736824a204f210a25e18609f5074d92c9d86334d875.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a4bb2e889faece00d82f736824a204f210a25e18609f5074d92c9d86334d875.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1452

memory/368-54-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download
memory/1324-56-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download