eafcf7e09ee0fcb2bdcaf195a5fc408f66c6b8321f78be51b1a8b3bb9fb5ad6c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:42

Target

0c0b1b920029e7bdf4f3c5d12304b931.dll
Size

44KB
MD5

0c0b1b920029e7bdf4f3c5d12304b931
SHA1

82ff623c6f6aa8207ea3f929b5553e3e23378e8c
SHA256

eafcf7e09ee0fcb2bdcaf195a5fc408f66c6b8321f78be51b1a8b3bb9fb5ad6c
SHA512

a578971c2ec695dd5d4f2f8df35baa3cb45b47dec76813f2637102cc7eb1785c9e682f79b27397b6426d98178806d39615c88a5d01f98358f9c0c81bf91aede3
SSDEEP

768:FfUDYeUSsaANCag3Npkav4TKnVQ/TYLuhDL5/c5gLa13YVE:FhpRpFLVTLau6

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1244	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1740	1044	regsvr32.exe	28
PID 1044 wrote to memory of 1740	1044	regsvr32.exe	28
PID 1044 wrote to memory of 1740	1044	regsvr32.exe	28
PID 1044 wrote to memory of 1740	1044	regsvr32.exe	28
PID 1044 wrote to memory of 1740	1044	regsvr32.exe	28
PID 1044 wrote to memory of 1740	1044	regsvr32.exe	28
PID 1044 wrote to memory of 1740	1044	regsvr32.exe	28
PID 1740 wrote to memory of 1244	1740	regsvr32.exe	29
PID 1740 wrote to memory of 1244	1740	regsvr32.exe	29
PID 1740 wrote to memory of 1244	1740	regsvr32.exe	29
PID 1740 wrote to memory of 1244	1740	regsvr32.exe	29
PID 1740 wrote to memory of 1244	1740	regsvr32.exe	29
PID 1740 wrote to memory of 1244	1740	regsvr32.exe	29
PID 1740 wrote to memory of 1244	1740	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c0b1b920029e7bdf4f3c5d12304b931.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c0b1b920029e7bdf4f3c5d12304b931.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0b1b920029e7bdf4f3c5d12304b931.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1244