def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:18

Target

Thunder/ComDlls/XunLeiBHO.dll
Size

93KB
MD5

4c3e0c0ac6b7657b50d481f850c6285f
SHA1

5437dbea79687cd689e79773df180820108d624f
SHA256

0736b83d2849106ccfe28a7df5ecf3d8e1efc83878b7163078254956b458fb7a
SHA512

45d6b670744a17a71a72ceed25990ffcd2090df27a9d33b13eab2c258896d7a4f8ea33a1b4059b2826d57427d012658c74bcef5836dd585549f7bb47833d78af
SSDEEP

1536:8rsrdlf3WZbkBN+qZ3njt+AqJQ4Y2BV6gqcrJEuuVcI9ix1x2pR5Zq:rdl+l7qFJ+lY2BV/rJEuuJkx1xo0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2988	1272	regsvr32.exe	16
PID 1272 wrote to memory of 2988	1272	regsvr32.exe	16
PID 1272 wrote to memory of 2988	1272	regsvr32.exe	16
PID 1272 wrote to memory of 2988	1272	regsvr32.exe	16
PID 1272 wrote to memory of 2988	1272	regsvr32.exe	16
PID 1272 wrote to memory of 2988	1272	regsvr32.exe	16
PID 1272 wrote to memory of 2988	1272	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\XunLeiBHO.dll
1⤵
PID:2988

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\XunLeiBHO.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1272