530b9eeec124ac7630ed6c4ab696642706504f3507efb0a496a8908c66c46e26

Analysis

max time kernel
97s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 23:00

Target

9a23e334d87dd1e612cb08ab58e0ec13.dll
Size

44KB
MD5

9a23e334d87dd1e612cb08ab58e0ec13
SHA1

b204af31d11ea5016dd28604f088182085fced7a
SHA256

530b9eeec124ac7630ed6c4ab696642706504f3507efb0a496a8908c66c46e26
SHA512

825a6eaa3026bc14579a9f34a204d0f62cb1dab5369d07ffdf90029f90823cdd730aaa70c49b08257264e9ced19bb1ac2d54e35e79b31971ce80388029f28a08
SSDEEP

768:0w+PpkavCkhfJ/mRUzbNHRSXheHiMmgLa1:0Y1Ox/mRUztQXwfDLa

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3412	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3412	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2256	452	regsvr32.exe	85
PID 452 wrote to memory of 2256	452	regsvr32.exe	85
PID 452 wrote to memory of 2256	452	regsvr32.exe	85
PID 2256 wrote to memory of 3412	2256	regsvr32.exe	86
PID 2256 wrote to memory of 3412	2256	regsvr32.exe	86
PID 2256 wrote to memory of 3412	2256	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a23e334d87dd1e612cb08ab58e0ec13.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9a23e334d87dd1e612cb08ab58e0ec13.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a23e334d87dd1e612cb08ab58e0ec13.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3412