7ddb2735176d8bb11b6ca37da259859f0143038db3e52dcb357e16ffb043c27c

Analysis

max time kernel
146s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 13:39

Target

72e2773cb5cee13a8e876a35d5444d3f.dll
Size

44KB
MD5

72e2773cb5cee13a8e876a35d5444d3f
SHA1

b54631295c520cd9c431120685b814162c317b75
SHA256

7ddb2735176d8bb11b6ca37da259859f0143038db3e52dcb357e16ffb043c27c
SHA512

b5806115eddc06d4a37c53843683086455b6e1703e08aa896ef6ff9e30065a7fb34faf96d0ac5a9e9264dbf29442d7af67249646fcd39b3b70ef96fc4fab1ce0
SSDEEP

384:5bFzOvZaBnQmQCs0Dtkav5BZEHz0ZxHOWOsT5G1ShKdJpJgLa0Mpsz:zvjQCtpkav/2OkWD5kSh8gLa16z

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4520	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4520	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 1360	4708	regsvr32.exe	88
PID 4708 wrote to memory of 1360	4708	regsvr32.exe	88
PID 4708 wrote to memory of 1360	4708	regsvr32.exe	88
PID 1360 wrote to memory of 4520	1360	regsvr32.exe	89
PID 1360 wrote to memory of 4520	1360	regsvr32.exe	89
PID 1360 wrote to memory of 4520	1360	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72e2773cb5cee13a8e876a35d5444d3f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\72e2773cb5cee13a8e876a35d5444d3f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\72e2773cb5cee13a8e876a35d5444d3f.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4520