ca493000c5eaff8432d6e2f3fc11a35fc019f1ff30806c661fba26e9941b5fb7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 09:55

Target
GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.dll
Size 40KB
Sample240110-lxswpaebc5
SHA256 417172e573177c921715ade25a63909ca986e11e16c3858ec0ef327c3d65355b
MD5 3f92f9c3ac33dcf97741eb937c3e7c44
SHA1 8c950edebb7749dc5939fd2841a1a81d2809ed68
SHA512 5c32833e48dd6e4f8b0073d7d23e0342e00d94e460bfd83d51087dafbf0706f7e255c1458155690b223310cb4b0a6bd3afbccdedc9ea13ecacc6ff6e28eb6a23
SSDEEP 384:GEkt05A3HUNImsuw0h/g2WMbMFGc6DJz9u9IFy9ILiTnuozMh+rRL+GhD8sQI7Nm:rA30NIfobNn9uBDT5RrB+GhD8yK1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2348	2308	regsvr32.exe	14
PID 2308 wrote to memory of 2348	2308	regsvr32.exe	14
PID 2308 wrote to memory of 2348	2308	regsvr32.exe	14
PID 2308 wrote to memory of 2348	2308	regsvr32.exe	14
PID 2308 wrote to memory of 2348	2308	regsvr32.exe	14
PID 2308 wrote to memory of 2348	2308	regsvr32.exe	14
PID 2308 wrote to memory of 2348	2308	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\plugin\MSG.dll
1⤵
PID:2348

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\plugin\MSG.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2308