7050dfa5be8589bbbb1c5f58177028c659c71b58118e6f34cbf4b87305ccb28c

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 09:42

Target

8ed39ddff6c207da2423820636a9541c.dll
Size

44KB
MD5

8ed39ddff6c207da2423820636a9541c
SHA1

829b980d45adea0edaa94f7c9b93a6fa39bb2be5
SHA256

7050dfa5be8589bbbb1c5f58177028c659c71b58118e6f34cbf4b87305ccb28c
SHA512

10314a4b62457f0d14518f55cbe33bc1a404c47a82134ae0d12640608cc0804d54d2afd9b81683f85d1fcc12c73838c63e75eaeed96ffade0d87f27f7251687f
SSDEEP

768:EkZ+AsIIpkavz7SHPX6wTybQnElIlgLa1c:LZ+qY7QXdyckLaK

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4724	744	regsvr32.exe	23
PID 744 wrote to memory of 4724	744	regsvr32.exe	23
PID 744 wrote to memory of 4724	744	regsvr32.exe	23
PID 4724 wrote to memory of 2588	4724	regsvr32.exe	47
PID 4724 wrote to memory of 2588	4724	regsvr32.exe	47
PID 4724 wrote to memory of 2588	4724	regsvr32.exe	47

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8ed39ddff6c207da2423820636a9541c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8ed39ddff6c207da2423820636a9541c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ed39ddff6c207da2423820636a9541c.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2588