59eb89f1ba93209eddbb1c102cc273cce5efe6cd58b0adf43c4fd23ac556b933

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 19:06

Target

baidubar.dll
Size

1.5MB
MD5

cdad50b363135c9d6fa591657638764e
SHA1

6d34a83fbbcc0cb1c7c40ba36797afd66cb97be0
SHA256

d710cef1798dbae5492705027390b16ff535b415d052fd0e5ef8325f8b39b5e2
SHA512

1dfdcd341266edacb5e736aa686f6ae17ffd9d588a7227ff64586c1c8f9b7527b39bec8e0f7de1471892f631479a3afab71c9a5b57d6495926c1832b907748c6
SSDEEP

24576:ivBjUPZeDApAS0738x/922WxuSGKtguodqp5laUr5LUi1OQl4o8g6jq:OjUBeDAp5m8F2LxuSG4Ud6a+E5jq

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2780	regsvr32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~2\baidu\bar\BaiduBar.dll	regsvr32.exe
File opened for modification	C:\PROGRA~2\baidu\bar\BaiduBar.dll	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	regsvr32.exe
2780	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2780	2720	regsvr32.exe	31
PID 2720 wrote to memory of 2780	2720	regsvr32.exe	31
PID 2720 wrote to memory of 2780	2720	regsvr32.exe	31
PID 2720 wrote to memory of 2780	2720	regsvr32.exe	31
PID 2720 wrote to memory of 2780	2720	regsvr32.exe	31
PID 2720 wrote to memory of 2780	2720	regsvr32.exe	31
PID 2720 wrote to memory of 2780	2720	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\baidubar.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\baidubar.dll
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2780

\PROGRA~2\baidu\bar\BaiduBar.dll

Filesize
1.5MB

MD5
cdad50b363135c9d6fa591657638764e

SHA1
6d34a83fbbcc0cb1c7c40ba36797afd66cb97be0

SHA256
d710cef1798dbae5492705027390b16ff535b415d052fd0e5ef8325f8b39b5e2

SHA512
1dfdcd341266edacb5e736aa686f6ae17ffd9d588a7227ff64586c1c8f9b7527b39bec8e0f7de1471892f631479a3afab71c9a5b57d6495926c1832b907748c6

Download Submit
memory/2780-2-0x0000000002670000-0x00000000027FA000-memory.dmp

Filesize
1.5MB

Download