4ab141447e1910ebe7115bb2e2e2fcf3f762323e32dadf072c6c00000eeac479

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 16:37

Target

7d77d872fda457133dd61dab2d401887.dll
Size

32KB
MD5

7d77d872fda457133dd61dab2d401887
SHA1

b746746abc4ad9ac65d1e4d5d5672d608361652c
SHA256

4ab141447e1910ebe7115bb2e2e2fcf3f762323e32dadf072c6c00000eeac479
SHA512

0de89ea0307d62ba731f348b594790c8e8e95f0106a2000112bb9c9755aee7fe5c014016e4b8cece5be5d6397f746f46a1ddab51f9806287b8a5a49da4e8d1b3
SSDEEP

384:XZk5vosQSr50Dtkav5/6gbELtj9uJpJgLa0Mpe:XmvYcOpkav5YLt5ugLa1

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2124	1744	regsvr32.exe	28
PID 1744 wrote to memory of 2124	1744	regsvr32.exe	28
PID 1744 wrote to memory of 2124	1744	regsvr32.exe	28
PID 1744 wrote to memory of 2124	1744	regsvr32.exe	28
PID 1744 wrote to memory of 2124	1744	regsvr32.exe	28
PID 1744 wrote to memory of 2124	1744	regsvr32.exe	28
PID 1744 wrote to memory of 2124	1744	regsvr32.exe	28
PID 2124 wrote to memory of 2868	2124	regsvr32.exe	29
PID 2124 wrote to memory of 2868	2124	regsvr32.exe	29
PID 2124 wrote to memory of 2868	2124	regsvr32.exe	29
PID 2124 wrote to memory of 2868	2124	regsvr32.exe	29
PID 2124 wrote to memory of 2868	2124	regsvr32.exe	29
PID 2124 wrote to memory of 2868	2124	regsvr32.exe	29
PID 2124 wrote to memory of 2868	2124	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d77d872fda457133dd61dab2d401887.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7d77d872fda457133dd61dab2d401887.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d77d872fda457133dd61dab2d401887.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2868