20fad721ad99f8a82c2eaf4743229f8c921d00b9ee0caa49c96edfd15156d749

Analysis

max time kernel
29s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-10-2022 05:33

Target

新建文件夹/Inet_Download_Manager_v6.37.14_Final/Internet Download Manager/IDMShellExt.dll
Size

32KB
MD5

e3ffdff31fed63050fa856dbdafb1e90
SHA1

6fcde3e14bdf2095d7ba52d86ce2aab76b75f5ab
SHA256

ecdd25fcc1a974e35ba8dd58f8d08af2ae81807d5df0eb9472151a4f1799e0a6
SHA512

1dd50cb7718d9ad3da727b41429c0724037687e30e2c2fa223b9e4395e3b1d14f5c23be2348f7c33506d982be9a882c5763f28a2df44254f3eab0ae6d5dc5255
SSDEEP

384:tM3kv2nxRY+oDpqSSR6V9OSNUeYpioRcY/HlLnYPLWSUHeMcCHOU7b8JN77hhFA:tM3kvmxRASReZWeoWY/lLjOCHBQ3hDA

Score

1^/10

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\ = "IDM Shell Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\新建文件夹\\Inet_Download_Manager_v6.37.14_Final\\Internet Download Manager\\IDMShellExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 288 wrote to memory of 1176	288	regsvr32.exe	regsvr32.exe
PID 288 wrote to memory of 1176	288	regsvr32.exe	regsvr32.exe
PID 288 wrote to memory of 1176	288	regsvr32.exe	regsvr32.exe
PID 288 wrote to memory of 1176	288	regsvr32.exe	regsvr32.exe
PID 288 wrote to memory of 1176	288	regsvr32.exe	regsvr32.exe
PID 288 wrote to memory of 1176	288	regsvr32.exe	regsvr32.exe
PID 288 wrote to memory of 1176	288	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\新建文件夹\Inet_Download_Manager_v6.37.14_Final\Internet Download Manager\IDMShellExt.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\新建文件夹\Inet_Download_Manager_v6.37.14_Final\Internet Download Manager\IDMShellExt.dll"
2⤵
- Modifies registry class
PID:1176

memory/288-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/1176-55-0x0000000000000000-mapping.dmp

Download
memory/1176-56-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download