20fad721ad99f8a82c2eaf4743229f8c921d00b9ee0caa49c96edfd15156d749

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-10-2022 05:33

Target

新建文件夹/Inet_Download_Manager_v6.37.14_Final/Internet Download Manager/IDMIECC.dll
Size

459KB
MD5

87b251b1ce38671a4af0a6e8a67caa06
SHA1

40cb0c16d7d6aa831df6ce67b4d1f3a407295035
SHA256

16cad77ae8104c8e1db4126f300ea29de0b1aaa2084031590c2ee180b06960ab
SHA512

1d243726debcb134857a0e32866ac783a32764fa893e2f181ea2c56651cb1088e99d8811381ac7d20ca096c0bfcd46b26660be4a39bdb79a15c8e950cd1e3cf4
SSDEEP

6144:0CvMMpdXUMCvpZzk8ND5/7wmAKpvq14Hpk798XLHAv8z4hYO8pNfopzDN:XvMMzCLN9FvXe9aHW8tOZzB

Score

1^/10

Modifies registry class 3 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2032 wrote to memory of 1944	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1944	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1944	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1944	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1944	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1944	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1944	2032	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\新建文件夹\Inet_Download_Manager_v6.37.14_Final\Internet Download Manager\IDMIECC.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\新建文件夹\Inet_Download_Manager_v6.37.14_Final\Internet Download Manager\IDMIECC.dll"
2⤵
- Modifies registry class
PID:1944

memory/1944-55-0x0000000000000000-mapping.dmp

Download
memory/1944-56-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/2032-54-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

Filesize
8KB

Download