def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:18

Target

Thunder/ComDlls/TDAtOnce.dll
Size

233KB
MD5

ac549002de2b438e24caaa7115358420
SHA1

a4056cc4d5cf189b928b00390eb9862ace8c3a57
SHA256

3a6f1895072b9bb80d4c93c98f94b9de7a19acc89c7a88941516f47421f731b3
SHA512

0ab7cab9ba210a85744229d7cbefc586600a051d44e7d7142f69934c2a342a2eb13db41984464d674dfe46a986448d2091e552b36e5546a12b58f78813947c41
SSDEEP

3072:vr/zlOMV/oYBHhkVtjXjNwXgVwVcPojmZmYKSQZKMn+fLOR6FVLbDLjXPL9jMXv2:D/zl1dlBkzfjicgjzP4r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2220	1708	regsvr32.exe	16
PID 1708 wrote to memory of 2220	1708	regsvr32.exe	16
PID 1708 wrote to memory of 2220	1708	regsvr32.exe	16
PID 1708 wrote to memory of 2220	1708	regsvr32.exe	16
PID 1708 wrote to memory of 2220	1708	regsvr32.exe	16
PID 1708 wrote to memory of 2220	1708	regsvr32.exe	16
PID 1708 wrote to memory of 2220	1708	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\TDAtOnce.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\TDAtOnce.dll
  2⤵
  PID:2220