7ddb2735176d8bb11b6ca37da259859f0143038db3e52dcb357e16ffb043c27c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:39

Target

72e2773cb5cee13a8e876a35d5444d3f.dll
Size

44KB
MD5

72e2773cb5cee13a8e876a35d5444d3f
SHA1

b54631295c520cd9c431120685b814162c317b75
SHA256

7ddb2735176d8bb11b6ca37da259859f0143038db3e52dcb357e16ffb043c27c
SHA512

b5806115eddc06d4a37c53843683086455b6e1703e08aa896ef6ff9e30065a7fb34faf96d0ac5a9e9264dbf29442d7af67249646fcd39b3b70ef96fc4fab1ce0
SSDEEP

384:5bFzOvZaBnQmQCs0Dtkav5BZEHz0ZxHOWOsT5G1ShKdJpJgLa0Mpsz:zvjQCtpkav/2OkWD5kSh8gLa16z

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2436	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2388	2428	regsvr32.exe	28
PID 2428 wrote to memory of 2388	2428	regsvr32.exe	28
PID 2428 wrote to memory of 2388	2428	regsvr32.exe	28
PID 2428 wrote to memory of 2388	2428	regsvr32.exe	28
PID 2428 wrote to memory of 2388	2428	regsvr32.exe	28
PID 2428 wrote to memory of 2388	2428	regsvr32.exe	28
PID 2428 wrote to memory of 2388	2428	regsvr32.exe	28
PID 2388 wrote to memory of 2436	2388	regsvr32.exe	29
PID 2388 wrote to memory of 2436	2388	regsvr32.exe	29
PID 2388 wrote to memory of 2436	2388	regsvr32.exe	29
PID 2388 wrote to memory of 2436	2388	regsvr32.exe	29
PID 2388 wrote to memory of 2436	2388	regsvr32.exe	29
PID 2388 wrote to memory of 2436	2388	regsvr32.exe	29
PID 2388 wrote to memory of 2436	2388	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72e2773cb5cee13a8e876a35d5444d3f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\72e2773cb5cee13a8e876a35d5444d3f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\72e2773cb5cee13a8e876a35d5444d3f.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2436