7fdd5ec909d3e858053e97226ce0045b127a99351642784095c8549298cd77a9

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 08:19

Target

deb4a2caa4c2ffc6ef7e1be96c782737.dll
Size

44KB
MD5

deb4a2caa4c2ffc6ef7e1be96c782737
SHA1

4d7dea62acce14a99ef0382231f42f0b1980645a
SHA256

7fdd5ec909d3e858053e97226ce0045b127a99351642784095c8549298cd77a9
SHA512

4f2e937e8120b9ec40922061c950237afd5899b8bb2cc3c885f1e036f8acf0a3ba5f567ba3abf30fe7211d12b8695d0f8393c08511e1f652aa11e2ab43635d26
SSDEEP

384:YqZYXEGWmH1mivLQIySiCWxYP+GadfBIDtkav5AyqDrQoq+dFWVk/JpJgLa0Mpt:VZYBPUHTymGYfBIpkaveLXdcVkhgLa1

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2404	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1828	4632	regsvr32.exe	99
PID 4632 wrote to memory of 1828	4632	regsvr32.exe	99
PID 4632 wrote to memory of 1828	4632	regsvr32.exe	99
PID 1828 wrote to memory of 2404	1828	regsvr32.exe	102
PID 1828 wrote to memory of 2404	1828	regsvr32.exe	102
PID 1828 wrote to memory of 2404	1828	regsvr32.exe	102

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\deb4a2caa4c2ffc6ef7e1be96c782737.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\deb4a2caa4c2ffc6ef7e1be96c782737.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb4a2caa4c2ffc6ef7e1be96c782737.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:3812