Different extensions, identical DLL content in sandbox report
A sandbox report records two differently named files with the same SHA-256, both targeted by regsvr32 commands. Other reports show similar loader activity and HTTPS requests to one shared IP, but do not tie a specific request to a specific process.
A Windows DLL appeared under two very different filenames in a sandbox report: one on the desktop with a .dll.ocx suffix, the other beneath SysWOW64 with a .tsu extension. Both were targets of recorded regsvr32.exe commands. Were these separate components, or the same content taking different forms in the execution record? Their matching SHA-256 answers the content question: the two files were identical.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read