4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:45

Target

4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll
Size

32KB
MD5

237af6a3737d693714bd1835bb3f7b4e
SHA1

d09674e184a66335c74988754d7392845929e893
SHA256

4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68
SHA512

960237ad6b84db578417a2e4c2425486e28c686dcfc223ee6c426fdc5e178d7e3698e4bd07dd49c787d099e2e563c1b53a0b62644aa00b58fc562788629268cd
SSDEEP

768:1wgqjSOrsl8uz3Alt88xnbkMdFogLa1h26Ni:1pbquzmy8xbkKpLart

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1176	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1384	1248	regsvr32.exe	26
PID 1248 wrote to memory of 1384	1248	regsvr32.exe	26
PID 1248 wrote to memory of 1384	1248	regsvr32.exe	26
PID 1248 wrote to memory of 1384	1248	regsvr32.exe	26
PID 1248 wrote to memory of 1384	1248	regsvr32.exe	26
PID 1248 wrote to memory of 1384	1248	regsvr32.exe	26
PID 1248 wrote to memory of 1384	1248	regsvr32.exe	26
PID 1384 wrote to memory of 1176	1384	regsvr32.exe	27
PID 1384 wrote to memory of 1176	1384	regsvr32.exe	27
PID 1384 wrote to memory of 1176	1384	regsvr32.exe	27
PID 1384 wrote to memory of 1176	1384	regsvr32.exe	27
PID 1384 wrote to memory of 1176	1384	regsvr32.exe	27
PID 1384 wrote to memory of 1176	1384	regsvr32.exe	27
PID 1384 wrote to memory of 1176	1384	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1176

memory/1248-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/1384-56-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download