def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:18

Target

Thunder/ComDlls/ThunderAgent.dll
Size

65KB
MD5

2d686d63b1d9fe43bbd1d504fbd8bf41
SHA1

5a0320fb275d0fe91df141cde0b803d6271429a6
SHA256

8f2e2dd0f0e61d76d357905681dd56771640c14e8dcbb445eabdc58e4661cb02
SHA512

3d1ead5a67dbd46fb49b4ad8175f4bb93ce890d25eb7486ec8ff71c8498a0bb3524a2d9d19cbee20ba7246245933f347651fe1c204511bd00e360168221881e1
SSDEEP

768:uQE9PE//bA35yxq7gtSZQA1n4nzXX3W/0bdDsCbJqtKQVVWQiilSxgPLG:H/b8YtU11mzXnbdDBJxQPWQnlSxWq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1936	1256	regsvr32.exe	14
PID 1256 wrote to memory of 1936	1256	regsvr32.exe	14
PID 1256 wrote to memory of 1936	1256	regsvr32.exe	14
PID 1256 wrote to memory of 1936	1256	regsvr32.exe	14
PID 1256 wrote to memory of 1936	1256	regsvr32.exe	14
PID 1256 wrote to memory of 1936	1256	regsvr32.exe	14
PID 1256 wrote to memory of 1936	1256	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\ThunderAgent.dll
1⤵
PID:1936

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\ThunderAgent.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1256