aae2787c3f2ba4cd498a3c2a1475673f3f218337d9e7c23e39258081e1c8b40c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:40

Target

01c72764de087f397a852684e6a517c4.dll
Size

32KB
MD5

01c72764de087f397a852684e6a517c4
SHA1

8b3904fc7b951f48360d14ee2d3e2717b157642b
SHA256

aae2787c3f2ba4cd498a3c2a1475673f3f218337d9e7c23e39258081e1c8b40c
SHA512

13d04ad2bbe2248e16f977f2d7af952470ad2657b4d5a43c9c1507111597f4c3d10ba650ba9c4abf12f07d4fbac0cb203ee428873a641b54cba0d891f7f66cae
SSDEEP

384:L5SMg6hnJltPtaptw69J+cRunSAVV7WmnYW4bo91LzAVUk5:F1gKJ/Ptanw6jj4nNVV7TnYW4bo91iX

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2288	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 2084	1112	regsvr32.exe	28
PID 1112 wrote to memory of 2084	1112	regsvr32.exe	28
PID 1112 wrote to memory of 2084	1112	regsvr32.exe	28
PID 1112 wrote to memory of 2084	1112	regsvr32.exe	28
PID 1112 wrote to memory of 2084	1112	regsvr32.exe	28
PID 1112 wrote to memory of 2084	1112	regsvr32.exe	28
PID 1112 wrote to memory of 2084	1112	regsvr32.exe	28
PID 2084 wrote to memory of 2288	2084	regsvr32.exe	29
PID 2084 wrote to memory of 2288	2084	regsvr32.exe	29
PID 2084 wrote to memory of 2288	2084	regsvr32.exe	29
PID 2084 wrote to memory of 2288	2084	regsvr32.exe	29
PID 2084 wrote to memory of 2288	2084	regsvr32.exe	29
PID 2084 wrote to memory of 2288	2084	regsvr32.exe	29
PID 2084 wrote to memory of 2288	2084	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\01c72764de087f397a852684e6a517c4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\01c72764de087f397a852684e6a517c4.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\01c72764de087f397a852684e6a517c4.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2288