9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff

Analysis

max time kernel
186s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:05

Target

9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll
Size

48KB
MD5

0250949b4ee668a6e2cf76d712699697
SHA1

8d12dd55a427cd8468ade777beb73b1a2b56cf5d
SHA256

9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff
SHA512

7c06b4d82233481cab4fed8668eee6d84e8fedf4d15beb1f8029e0a8f0c244d3932868c747c861606cf935553eae59e1dcd4fb17b8aca32c995426b593779638
SSDEEP

768:PQT5OMn7ibKxAPkCC9lLu/LAAlh3WBIbPovZP+25kK8TqmVpzUt1mn:PQT4Mn7sEAPTARu/LAAD3WBIbPOYftuk

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2304	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1920	4236	regsvr32.exe	78
PID 4236 wrote to memory of 1920	4236	regsvr32.exe	78
PID 4236 wrote to memory of 1920	4236	regsvr32.exe	78
PID 1920 wrote to memory of 2304	1920	regsvr32.exe	79
PID 1920 wrote to memory of 2304	1920	regsvr32.exe	79
PID 1920 wrote to memory of 2304	1920	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d1014c063aa0660e13eabc4b0a0335877652aae712d0eea2c5b087ba66eb2ff.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2304