89697a81eea1f36a9cd76c46900364fff3b341c3ff41d6843292d84ae1cbb378

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 05:39

Target

$PROGRAMFILES/alotappbar/bin/alotappbar.dll
Size

926KB
MD5

6630dddcf182cd59496d9990bf61f8c6
SHA1

57b471ae72dd40311f1b7a1f125242bebdf8f448
SHA256

decf27e9cf31e746760893badce268ea5ad34bf60277865b275547a42e1445ba
SHA512

fadce6624c9897c38b36baf468708bcbbaacf90fbf01abd7b552dba8acc8a0d3e2d4f23f5a4ebc491065cbe8409015b5b36ad6236c28294408c27b85b8c1a67a
SSDEEP

24576:S0pSBTiOLXIDtGUpMb2nvg14PhG6ZRCom81sPri6ZZle3xUeKOkaFRixmT:SRBHL4f0mG6fCo11Qri6ZZuhkaFRixmT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3052	2520	regsvr32.exe	30
PID 2520 wrote to memory of 3052	2520	regsvr32.exe	30
PID 2520 wrote to memory of 3052	2520	regsvr32.exe	30
PID 2520 wrote to memory of 3052	2520	regsvr32.exe	30
PID 2520 wrote to memory of 3052	2520	regsvr32.exe	30
PID 2520 wrote to memory of 3052	2520	regsvr32.exe	30
PID 2520 wrote to memory of 3052	2520	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alotappbar\bin\alotappbar.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alotappbar\bin\alotappbar.dll
  2⤵
  PID:3052