6734e708c6beaf74eeca069129144d5fe7aec8b9a3ac3154a1e5df6647782f9b

Analysis

max time kernel
90s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 04:33

Target

CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFCO42D.dll
Size

345KB
MD5

a6d49b9367d4eade1e0217aeb7422ff5
SHA1

8cc08df30a815305f42feca44a3db91c70544b70
SHA256

f306d0671f2c377819d26e0cd1f52bfd301436f45cb436c203030aebb9ee67e4
SHA512

d0682e4a027cbd73f982b760db0423f61d449db4f40b98c8aac2624c6b6700162c01ee70fa58810142018d8a1800c5ac00ab20804ee574281b3aded83c3fec42
SSDEEP

6144:CnmrVCWFXGTZeWHa/7dqpdNpn0ZCynsKqmgVpAcpHV7a:CmRCGenAYx9I

Score

1^/10

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2640	2236	regsvr32.exe	81
PID 2236 wrote to memory of 2640	2236	regsvr32.exe	81
PID 2236 wrote to memory of 2640	2236	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFCO42D.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFCO42D.dll
  2⤵
  - Modifies registry class
  PID:2640