211c37d00b6555ca57c72c779220f31fdb21394436066991149c604487b44991

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 10:21

Target

plugins/NPSWF32_18_0_0_209.dll
Size

16.6MB
MD5

fd82108fd60b63010325d9af6f00af99
SHA1

a8a3a53e7b0e5713e93acbcf27d4657c324726c4
SHA256

819cc0414074d329025ebfef2079cd277ef9e5beedb8cbbebe6d646825de85bf
SHA512

8d0fcbe5948aa61e434260fd38b50eb79272a7532a20271333dbf1f507aff4a4f48edf414bab031321d9ab8540b2b8769a54eb013f8508edb0408e9fc9c80b0c
SSDEEP

393216:bjzPNjLES4YLhP65DvA/sG0kHPwuajnin9N7W3HuopBws4Pgr7X:bjzPNvES4YLhku97W3ES7X

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

regsvr32.exe

pid process

2992 regsvr32.exe

pid	process
2992	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2848 wrote to memory of 2992	2848	regsvr32.exe	regsvr32.exe
PID 2848 wrote to memory of 2992	2848	regsvr32.exe	regsvr32.exe
PID 2848 wrote to memory of 2992	2848	regsvr32.exe	regsvr32.exe
PID 2848 wrote to memory of 2992	2848	regsvr32.exe	regsvr32.exe
PID 2848 wrote to memory of 2992	2848	regsvr32.exe	regsvr32.exe
PID 2848 wrote to memory of 2992	2848	regsvr32.exe	regsvr32.exe
PID 2848 wrote to memory of 2992	2848	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\plugins\NPSWF32_18_0_0_209.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\plugins\NPSWF32_18_0_0_209.dll
2⤵
- Suspicious use of SetWindowsHookEx
PID:2992