00f943b1206e73102396b34a8a21d7f4b4ae808e206931cab2eafeefdf83f112

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 03:22

Target

d5147e3cce30f9ca8eee9bed0a3eabd5.dll
Size

594KB
MD5

d5147e3cce30f9ca8eee9bed0a3eabd5
SHA1

bbadef55354898694a01a2aec72b255b9ffeb8a0
SHA256

00f943b1206e73102396b34a8a21d7f4b4ae808e206931cab2eafeefdf83f112
SHA512

229823b98761c6a768868508fd5fa5980aa35e3633126c84552325409c471a7f705ddb9fafd94d09a9f949298d1ddd2286df5f5f0c859a08f2f3e1e1ea1bf6f9
SSDEEP

12288:YpjJobAMlUVocKO/HxhrF3Z4mxx67sIcOa/Y91TVKtjxXTot:ujJKAM6u0/HrQmXksINwrNxXkt

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2872	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2872	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2872	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2872	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2872	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2872	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2872	1568	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d5147e3cce30f9ca8eee9bed0a3eabd5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d5147e3cce30f9ca8eee9bed0a3eabd5.dll
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2872

memory/2872-0-0x00000000022E0000-0x00000000023D5000-memory.dmp

Filesize
980KB

Download
memory/2872-2-0x0000000003700000-0x0000000003703000-memory.dmp

Filesize
12KB

Download
memory/2872-1-0x00000000023E0000-0x0000000002434000-memory.dmp

Filesize
336KB

Download
memory/2872-3-0x00000000022E0000-0x00000000023D5000-memory.dmp

Filesize
980KB

Download
memory/2872-4-0x00000000023E0000-0x0000000002434000-memory.dmp

Filesize
336KB

Download