0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9

Analysis

max time kernel
86s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
Size

128KB
MD5

342fb27ff4831b3a7000170fea897a66
SHA1

4adc0ba6dac2937af6eccbca257cfdbe25cf1961
SHA256

0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9
SHA512

ca7cd8712e716ef8bcb5dd11e7065041f5a3fbd97318997f423755a1253c1b0e081ea1b5027c819fa18eab53d86c034672ea716c1d8921c759c7245d6ffb7a27
SSDEEP

3072:OdEdnvOjI0evGkPTFEUuEU78WG0RO9uQoFEw/7rG9KVuaduMyZFzLr2n5lhRTY1:D0ROQYSyfj25HR+

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}\CLSID = "{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}\ = "LEAD Video YUV Converter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}\FriendlyName = "LEAD Video YUV Converter"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}\FilterData = 020000000100600002000000000000003070693300000000000000000d000000000000000000000030747933000000002001000030010000317479330000000020010000400100003274793300000000200100005001000033747933000000002001000060010000347479330000000020010000700100003574793300000000200100008001000036747933000000002001000090010000377479330000000020010000a0010000387479330000000020010000b0010000397479330000000020010000c00100003a7479330000000020010000d00100003b7479330000000020010000e00100003c7479330000000020010000f0010000317069330800000000000000010000000000000000000000307479330000000020010000000200007669647300001000800000aa00389b715955593200001000800000aa00389b715956595500001000800000aa00389b714959553200001000800000aa00389b714959553100001000800000aa00389b715559565900001000800000aa00389b715934315000001000800000aa00389b715956553900001000800000aa00389b714959343100001000800000aa00389b714955595600001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b714959555600001000800000aa00389b717632313000001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B7DAF2-38C5-11D5-91F6-00104BDB8FF9}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4924	4940	regsvr32.exe	81
PID 4940 wrote to memory of 4924	4940	regsvr32.exe	81
PID 4940 wrote to memory of 4924	4940	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
  2⤵
  - Modifies registry class
  PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-133-0x000000001D200000-0x000000001D220000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads