17a529a997b683445e82447eb125de60fa0abc63c81a656237893c3f0950fcc2

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 17:57

Target

cf3.3自动挂机外挂/CoolBoySkin1.3.dll
Size

1.7MB
MD5

84940e6fcb8164b8090cbe9e2ec987c9
SHA1

614083240f3d8749534d172b5689725475909820
SHA256

de48b16014907f52546ac67667c0cc2555b7a9b0f18395009719d4b7e35dd716
SHA512

c90aba1acc32ed8ffcdf47ddfb69ddb3e0eeeb40b56cdda6db059c8d2fc00f959b03a6b449c91f9e47d78f2b1ac0d478ac79b91fa07021b2b61b51bf7760ee3d
SSDEEP

49152:ZIbFoFR6Ly6mZU2g0gyyCyy3yL+wFKGHKJZU2g0gyyCyy3yL+wFKG1:YCLgyyCyy3yL+fXLgyyCyy3yL+k

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1952	2924	regsvr32.exe	28
PID 2924 wrote to memory of 1952	2924	regsvr32.exe	28
PID 2924 wrote to memory of 1952	2924	regsvr32.exe	28
PID 2924 wrote to memory of 1952	2924	regsvr32.exe	28
PID 2924 wrote to memory of 1952	2924	regsvr32.exe	28
PID 2924 wrote to memory of 1952	2924	regsvr32.exe	28
PID 2924 wrote to memory of 1952	2924	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf3.3自动挂机外挂\CoolBoySkin1.3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cf3.3自动挂机外挂\CoolBoySkin1.3.dll
  2⤵
  PID:1952