7fdd5ec909d3e858053e97226ce0045b127a99351642784095c8549298cd77a9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 08:19

Target

deb4a2caa4c2ffc6ef7e1be96c782737.dll
Size

44KB
MD5

deb4a2caa4c2ffc6ef7e1be96c782737
SHA1

4d7dea62acce14a99ef0382231f42f0b1980645a
SHA256

7fdd5ec909d3e858053e97226ce0045b127a99351642784095c8549298cd77a9
SHA512

4f2e937e8120b9ec40922061c950237afd5899b8bb2cc3c885f1e036f8acf0a3ba5f567ba3abf30fe7211d12b8695d0f8393c08511e1f652aa11e2ab43635d26
SSDEEP

384:YqZYXEGWmH1mivLQIySiCWxYP+GadfBIDtkav5AyqDrQoq+dFWVk/JpJgLa0Mpt:VZYBPUHTymGYfBIpkaveLXdcVkhgLa1

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1380	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1380	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1612	1220	regsvr32.exe	28
PID 1220 wrote to memory of 1612	1220	regsvr32.exe	28
PID 1220 wrote to memory of 1612	1220	regsvr32.exe	28
PID 1220 wrote to memory of 1612	1220	regsvr32.exe	28
PID 1220 wrote to memory of 1612	1220	regsvr32.exe	28
PID 1220 wrote to memory of 1612	1220	regsvr32.exe	28
PID 1220 wrote to memory of 1612	1220	regsvr32.exe	28
PID 1612 wrote to memory of 1380	1612	regsvr32.exe	29
PID 1612 wrote to memory of 1380	1612	regsvr32.exe	29
PID 1612 wrote to memory of 1380	1612	regsvr32.exe	29
PID 1612 wrote to memory of 1380	1612	regsvr32.exe	29
PID 1612 wrote to memory of 1380	1612	regsvr32.exe	29
PID 1612 wrote to memory of 1380	1612	regsvr32.exe	29
PID 1612 wrote to memory of 1380	1612	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\deb4a2caa4c2ffc6ef7e1be96c782737.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\deb4a2caa4c2ffc6ef7e1be96c782737.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb4a2caa4c2ffc6ef7e1be96c782737.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1380