89697a81eea1f36a9cd76c46900364fff3b341c3ff41d6843292d84ae1cbb378

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 05:39

Target

$PROGRAMFILES/alotappbar/bin/alothelper.dll
Size

47KB
MD5

5ed32a1675e1739da11affc0463b9dc6
SHA1

edc23cd5cf91f7840d681832fc47a750f8b95981
SHA256

909c18d5bd184cc7cbae0e26cb9c0b792119b594a033e10019a5f2f0ddf35b7c
SHA512

b176bf63d701d1385bcdd6165b9d29cc18e105cd45d9ea4be3217904c9e532448a71325bce76dc817cbede2b6f5dda5d78ecf24def439794374947080b23f302
SSDEEP

768:75YQhUbgis5yiRGo+As+8somNbIwqpHB0UgInNiu7zlmPSrg5ZXLXbChU:7x+bvs5HL+AS2zqj0CBlySrgfX3ChU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2684	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2684	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2684	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2684	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2684	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2684	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2684	2260	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alotappbar\bin\alothelper.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alotappbar\bin\alothelper.dll
  2⤵
  PID:2684

memory/2684-1-0x0000000000A40000-0x0000000000B31000-memory.dmp

Filesize
964KB

Download