887549bb390b18ed756ca4c73a6f5c2e987a318b667550f3641c5223ca37ed03

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 01:33

Target

887549bb390b18ed756ca4c73a6f5c2e987a318b667550f3641c5223ca37ed03.dll
Size

48KB
MD5

ef6d485b813cbf51e881b48cd6c27a1e
SHA1

3b6c788644915b3d53cc40bbf8f1a59bfe126371
SHA256

887549bb390b18ed756ca4c73a6f5c2e987a318b667550f3641c5223ca37ed03
SHA512

c402a1f7400f0728429f12d41bd53966994ec29837e9fad5c1c2af19ffa9518760426c9dbea2b2997786dad149c205dfac755319420e0fba763ee960e1fa8d98
SSDEEP

768:tGj3rMCQtuIGAXTNQ1iIv5jvHwfZXvmJ5e5HDNhuDu65FdjR62QPBa282:VtuIlNS9vHmxJ5jzeXFZR6z

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 884	1488	regsvr32.exe	27
PID 1488 wrote to memory of 884	1488	regsvr32.exe	27
PID 1488 wrote to memory of 884	1488	regsvr32.exe	27
PID 1488 wrote to memory of 884	1488	regsvr32.exe	27
PID 1488 wrote to memory of 884	1488	regsvr32.exe	27
PID 1488 wrote to memory of 884	1488	regsvr32.exe	27
PID 1488 wrote to memory of 884	1488	regsvr32.exe	27
PID 884 wrote to memory of 2004	884	regsvr32.exe	28
PID 884 wrote to memory of 2004	884	regsvr32.exe	28
PID 884 wrote to memory of 2004	884	regsvr32.exe	28
PID 884 wrote to memory of 2004	884	regsvr32.exe	28
PID 884 wrote to memory of 2004	884	regsvr32.exe	28
PID 884 wrote to memory of 2004	884	regsvr32.exe	28
PID 884 wrote to memory of 2004	884	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\887549bb390b18ed756ca4c73a6f5c2e987a318b667550f3641c5223ca37ed03.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\887549bb390b18ed756ca4c73a6f5c2e987a318b667550f3641c5223ca37ed03.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\887549bb390b18ed756ca4c73a6f5c2e987a318b667550f3641c5223ca37ed03.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2004

memory/884-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1488-54-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download