ca493000c5eaff8432d6e2f3fc11a35fc019f1ff30806c661fba26e9941b5fb7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 09:55

Target
GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.dll
Size 40KB
Sample240110-lxswpaebc5
SHA256 c9515d3d0e549e978fdd8ae762bd7b73f1ec1dd49c058ad9cd4537902db87670
MD5 1b12290100f56cf13ac7bd631adebe7d
SHA1 d996c99e4ccb91876e9da397ec547aebb83c0c94
SHA512 cd0e417f7ef5d1749f78bded6ac77bcc15aa72268bbb2ec8322f964a11d70f0ecfaaa4ecc10d13a2df743329982bd88fdb8f7f785a50dad33d112e27e372b815
SSDEEP 384:Ik5Y5bNAguM1vVOiignzJjaJ5htgk0jDrmq5pp/xI3eYP5zo9Y:I4Y5pZVLiQJmltgrjDrmq5/K3ce
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2132	2412	regsvr32.exe	28
PID 2412 wrote to memory of 2132	2412	regsvr32.exe	28
PID 2412 wrote to memory of 2132	2412	regsvr32.exe	28
PID 2412 wrote to memory of 2132	2412	regsvr32.exe	28
PID 2412 wrote to memory of 2132	2412	regsvr32.exe	28
PID 2412 wrote to memory of 2132	2412	regsvr32.exe	28
PID 2412 wrote to memory of 2132	2412	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\plugin\FILE.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\plugin\FILE.dll
  2⤵
  PID:2132