4ab141447e1910ebe7115bb2e2e2fcf3f762323e32dadf072c6c00000eeac479

Analysis

max time kernel
117s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 16:37

Target

7d77d872fda457133dd61dab2d401887.dll
Size

32KB
MD5

7d77d872fda457133dd61dab2d401887
SHA1

b746746abc4ad9ac65d1e4d5d5672d608361652c
SHA256

4ab141447e1910ebe7115bb2e2e2fcf3f762323e32dadf072c6c00000eeac479
SHA512

0de89ea0307d62ba731f348b594790c8e8e95f0106a2000112bb9c9755aee7fe5c014016e4b8cece5be5d6397f746f46a1ddab51f9806287b8a5a49da4e8d1b3
SSDEEP

384:XZk5vosQSr50Dtkav5/6gbELtj9uJpJgLa0Mpe:XmvYcOpkav5YLt5ugLa1

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3948	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3948	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3784	1356	regsvr32.exe	21
PID 1356 wrote to memory of 3784	1356	regsvr32.exe	21
PID 1356 wrote to memory of 3784	1356	regsvr32.exe	21
PID 3784 wrote to memory of 3948	3784	regsvr32.exe	46
PID 3784 wrote to memory of 3948	3784	regsvr32.exe	46
PID 3784 wrote to memory of 3948	3784	regsvr32.exe	46

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d77d872fda457133dd61dab2d401887.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7d77d872fda457133dd61dab2d401887.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d77d872fda457133dd61dab2d401887.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3948