1448aec568bd15a5df6a67fe357d65310426ffc7c02c11b7b10767a4ef7a7cae

Analysis

max time kernel
140s
max time network
153s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 13:45

Target

98b9bd9da1ad5c48dc82f3c7152494217823514b5fc6d5b8e53b9b5a8dec5f7a.dll
Size

167KB
MD5

fe43e3595e8e79f086fe9b367e8d7005
SHA1

fbc5f7531e7dd3969e41b81c77c91f93ab5625d4
SHA256

98b9bd9da1ad5c48dc82f3c7152494217823514b5fc6d5b8e53b9b5a8dec5f7a
SHA512

781442da825d382964747248cc2162fad7afabfa97069a0eda7da04fe2578de9ab6b4e90d00272c67ad00a117f8fc62519e7aaab1b58adc253165a8d29325fde
SSDEEP

3072:gab7+a6RKcswmok6hxrFO/DjPehy+e6kylW8G:fQ1sw7hxZObqX3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1676	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1632	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1632	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1632	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1632	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1632	1676	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\98b9bd9da1ad5c48dc82f3c7152494217823514b5fc6d5b8e53b9b5a8dec5f7a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LmeParmQOILh\IOZuhsAeOm.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632