8ce1a5fa5c2a8431b8f986ae50ce62669b5f9a98f156b99bffcd8c60288ed8b1

Analysis

max time kernel
114s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 06:07

Target

8ce1a5fa5c2a8431b8f986ae50ce62669b5f9a98f156b99bffcd8c60288ed8b1.dll
Size

33KB
MD5

71d7a5efed70e25e16ff2d3d88404a00
SHA1

e73aee5db73d2b5e0d1579ef90195e6e70b91a1b
SHA256

8ce1a5fa5c2a8431b8f986ae50ce62669b5f9a98f156b99bffcd8c60288ed8b1
SHA512

a3116069cfbe8136844782e20e5425e4829e0b33d624a3bb9d9950437839c4835b3df70fc31693c9abfa363dc7e0a47131143c52c0871c7e3810e041aebccf55
SSDEEP

768:5uQNAT8oES064pB2ZLzibBcZoEXcctiedHgmGYca5flbNhaLpnj2:5uQ2TxVL4pB2ZLzsBpEXcmijmbcidCFa

Score

1^/10

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D94B2EE4-53E3-473c-9F5C-DCB69D1FB9DB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D94B2EE4-53E3-473c-9F5C-DCB69D1FB9DB}\ = "NDIS HC"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D94B2EE4-53E3-473c-9F5C-DCB69D1FB9DB}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D94B2EE4-53E3-473c-9F5C-DCB69D1FB9DB}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8ce1a5fa5c2a8431b8f986ae50ce62669b5f9a98f156b99bffcd8c60288ed8b1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D94B2EE4-53E3-473c-9F5C-DCB69D1FB9DB}\InProcServer32\ThreadingModel = "Free"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D94B2EE4-53E3-473c-9F5C-DCB69D1FB9DB}\InProcServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D94B2EE4-53E3-473c-9F5C-DCB69D1FB9DB}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 5072	1672	regsvr32.exe	83
PID 1672 wrote to memory of 5072	1672	regsvr32.exe	83
PID 1672 wrote to memory of 5072	1672	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8ce1a5fa5c2a8431b8f986ae50ce62669b5f9a98f156b99bffcd8c60288ed8b1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8ce1a5fa5c2a8431b8f986ae50ce62669b5f9a98f156b99bffcd8c60288ed8b1.dll
  2⤵
  - Modifies registry class
  PID:5072

memory/5072-133-0x0000000075230000-0x000000007524F000-memory.dmp

Filesize
124KB

Download
memory/5072-134-0x0000000075230000-0x000000007524F000-memory.dmp

Filesize
124KB

Download