44e12bae1e5d309752e35b420897ebaf229a041ce9ad35c5b47dd224a2499071

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 02:00

Target

I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc_payload_carved.dll
Size

347KB
MD5

c5f25f45c07cb4e0291eea6e8a8779fb
SHA1

2e17aaee110bf573587193f0e374eecd8b75c228
SHA256

44e12bae1e5d309752e35b420897ebaf229a041ce9ad35c5b47dd224a2499071
SHA512

3b5a101ad0c7853e04918e3831aac9ddaadcb539ad9e2aaeca87a80e011e2d57443cc3158117f9cf6179960cf54a5475174e7c2a29fa8925c22b3a0ab24011cd
SSDEEP

6144:BX1K0hROWQHfYtH4ve6REwSBPuuOVN7Oc5jthTq5wzDigK:F1KMEWQHfaYveI6OT7x/1Dig

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3052 regsvr32.exe
2052 regsvr32.exe
2052 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3052 regsvr32.exe

pid	process
3052	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3052 wrote to memory of 2052	3052	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 2052	3052	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 2052	3052	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 2052	3052	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 2052	3052	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YYuOhiWPWJJcMDPe\pjALU.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052