9b92f83fa9fc39f87024cec7526b8b3754775aac90f8acc1fff90678ce4d35b6

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 05:06

Target

9b92f83fa9fc39f87024cec7526b8b3754775aac90f8acc1fff90678ce4d35b6.dll
Size

171KB
MD5

4eff6daeac26578d6f18ba63ffb05a00
SHA1

d269011ddcbaeacd095f347d38aa6e1134bb4dc9
SHA256

9b92f83fa9fc39f87024cec7526b8b3754775aac90f8acc1fff90678ce4d35b6
SHA512

e7774f7d7ac80fc5b950d6f6804035d6a6ba849a4e5b5478c955146bafba2652ce02a493e41082b66999e375a2f0edb519769911c18d327f233568be1dac6dc6
SSDEEP

3072:FExx7Y3FzPVkDuBnKdolacToqbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7V/se:FEiJnRlacTBvP6bQ7yMP+DE827V0iB

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9b92f83fa9fc39f87024cec7526b8b3754775aac90f8acc1fff90678ce4d35b6.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9b92f83fa9fc39f87024cec7526b8b3754775aac90f8acc1fff90678ce4d35b6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9b92f83fa9fc39f87024cec7526b8b3754775aac90f8acc1fff90678ce4d35b6.dll
  2⤵
  - Modifies registry class
  PID:1448

memory/1448-56-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1572-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download