eafcf7e09ee0fcb2bdcaf195a5fc408f66c6b8321f78be51b1a8b3bb9fb5ad6c

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 02:42

Target

0c0b1b920029e7bdf4f3c5d12304b931.dll
Size

44KB
MD5

0c0b1b920029e7bdf4f3c5d12304b931
SHA1

82ff623c6f6aa8207ea3f929b5553e3e23378e8c
SHA256

eafcf7e09ee0fcb2bdcaf195a5fc408f66c6b8321f78be51b1a8b3bb9fb5ad6c
SHA512

a578971c2ec695dd5d4f2f8df35baa3cb45b47dec76813f2637102cc7eb1785c9e682f79b27397b6426d98178806d39615c88a5d01f98358f9c0c81bf91aede3
SSDEEP

768:FfUDYeUSsaANCag3Npkav4TKnVQ/TYLuhDL5/c5gLa13YVE:FhpRpFLVTLau6

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3196	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3196	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2368	2648	regsvr32.exe	90
PID 2648 wrote to memory of 2368	2648	regsvr32.exe	90
PID 2648 wrote to memory of 2368	2648	regsvr32.exe	90
PID 2368 wrote to memory of 3196	2368	regsvr32.exe	95
PID 2368 wrote to memory of 3196	2368	regsvr32.exe	95
PID 2368 wrote to memory of 3196	2368	regsvr32.exe	95

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c0b1b920029e7bdf4f3c5d12304b931.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c0b1b920029e7bdf4f3c5d12304b931.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0b1b920029e7bdf4f3c5d12304b931.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3196