9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:05

Target

9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll
Size

48KB
MD5

0250949b4ee668a6e2cf76d712699697
SHA1

8d12dd55a427cd8468ade777beb73b1a2b56cf5d
SHA256

9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff
SHA512

7c06b4d82233481cab4fed8668eee6d84e8fedf4d15beb1f8029e0a8f0c244d3932868c747c861606cf935553eae59e1dcd4fb17b8aca32c995426b593779638
SSDEEP

768:PQT5OMn7ibKxAPkCC9lLu/LAAlh3WBIbPovZP+25kK8TqmVpzUt1mn:PQT4Mn7sEAPTARu/LAAD3WBIbPOYftuk

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1376	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1376	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 956	960	regsvr32.exe	27
PID 960 wrote to memory of 956	960	regsvr32.exe	27
PID 960 wrote to memory of 956	960	regsvr32.exe	27
PID 960 wrote to memory of 956	960	regsvr32.exe	27
PID 960 wrote to memory of 956	960	regsvr32.exe	27
PID 960 wrote to memory of 956	960	regsvr32.exe	27
PID 960 wrote to memory of 956	960	regsvr32.exe	27
PID 956 wrote to memory of 1376	956	regsvr32.exe	28
PID 956 wrote to memory of 1376	956	regsvr32.exe	28
PID 956 wrote to memory of 1376	956	regsvr32.exe	28
PID 956 wrote to memory of 1376	956	regsvr32.exe	28
PID 956 wrote to memory of 1376	956	regsvr32.exe	28
PID 956 wrote to memory of 1376	956	regsvr32.exe	28
PID 956 wrote to memory of 1376	956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1376

memory/956-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/960-54-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download