4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68

Analysis

max time kernel
295s
max time network
357s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 14:45

Target

4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll
Size

32KB
MD5

237af6a3737d693714bd1835bb3f7b4e
SHA1

d09674e184a66335c74988754d7392845929e893
SHA256

4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68
SHA512

960237ad6b84db578417a2e4c2425486e28c686dcfc223ee6c426fdc5e178d7e3698e4bd07dd49c787d099e2e563c1b53a0b62644aa00b58fc562788629268cd
SSDEEP

768:1wgqjSOrsl8uz3Alt88xnbkMdFogLa1h26Ni:1pbquzmy8xbkKpLart

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1500	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1500	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 3656	4304	regsvr32.exe	82
PID 4304 wrote to memory of 3656	4304	regsvr32.exe	82
PID 4304 wrote to memory of 3656	4304	regsvr32.exe	82
PID 3656 wrote to memory of 1500	3656	regsvr32.exe	83
PID 3656 wrote to memory of 1500	3656	regsvr32.exe	83
PID 3656 wrote to memory of 1500	3656	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a780c2caaf6518f954d40f79bc857964294ca1b22dde3eb02f938ca9b312e68.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1500