530b9eeec124ac7630ed6c4ab696642706504f3507efb0a496a8908c66c46e26

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 23:00

Target

9a23e334d87dd1e612cb08ab58e0ec13.dll
Size

44KB
MD5

9a23e334d87dd1e612cb08ab58e0ec13
SHA1

b204af31d11ea5016dd28604f088182085fced7a
SHA256

530b9eeec124ac7630ed6c4ab696642706504f3507efb0a496a8908c66c46e26
SHA512

825a6eaa3026bc14579a9f34a204d0f62cb1dab5369d07ffdf90029f90823cdd730aaa70c49b08257264e9ced19bb1ac2d54e35e79b31971ce80388029f28a08
SSDEEP

768:0w+PpkavCkhfJ/mRUzbNHRSXheHiMmgLa1:0Y1Ox/mRUztQXwfDLa

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1968	2224	regsvr32.exe	28
PID 2224 wrote to memory of 1968	2224	regsvr32.exe	28
PID 2224 wrote to memory of 1968	2224	regsvr32.exe	28
PID 2224 wrote to memory of 1968	2224	regsvr32.exe	28
PID 2224 wrote to memory of 1968	2224	regsvr32.exe	28
PID 2224 wrote to memory of 1968	2224	regsvr32.exe	28
PID 2224 wrote to memory of 1968	2224	regsvr32.exe	28
PID 1968 wrote to memory of 2072	1968	regsvr32.exe	29
PID 1968 wrote to memory of 2072	1968	regsvr32.exe	29
PID 1968 wrote to memory of 2072	1968	regsvr32.exe	29
PID 1968 wrote to memory of 2072	1968	regsvr32.exe	29
PID 1968 wrote to memory of 2072	1968	regsvr32.exe	29
PID 1968 wrote to memory of 2072	1968	regsvr32.exe	29
PID 1968 wrote to memory of 2072	1968	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a23e334d87dd1e612cb08ab58e0ec13.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9a23e334d87dd1e612cb08ab58e0ec13.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a23e334d87dd1e612cb08ab58e0ec13.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2072