6715c0eff16eb7fb62b4e3c5f355b0548c695e5b12705a731a9abb4f8c7fef31 | Triage

Analysis

max time kernel
10s
max time network
234s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 13:25

Sharing

Report Analysis Logs

General

Target

data/App/x64/ASIO4ALL v2/asio4all.dll
Size

115KB
MD5

de9b771e11a5800254354124e16856ee
SHA1

d86ec1217077f65bdae1bc207ba16ad5ed98feaf
SHA256

f53f755e8ae24f9e6d1b925bf32702cf4bd0a92511f87d6c3503830a1fbef9da
SHA512

ea0c022843997c05d9d542479dc8c32e6df9bb0e936b1d3e12aeba3ee46b45cee059e640bc0fa777535befc1cfb9d08cddfc32c6090999c19a4171cf479ababd
SSDEEP

1536:ZvzplGOrgSF1HpH01/n8Cx3TzN9CVmkcu32hl:xJjeRDu32

Score

1^/10

Malware Config

Signatures

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\ = "ASIO4ALL v2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\data\\App\\x64\\ASIO4ALL v2\\asio4all.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 968 wrote to memory of 984	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 984	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 984	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 984	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 984	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 984	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 984	968	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\data\App\x64\ASIO4ALL v2\asio4all.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\data\App\x64\ASIO4ALL v2\asio4all.dll"
  2⤵
  - Modifies registry class
  PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download
memory/984-55-0x0000000000000000-mapping.dmp

Download
memory/984-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download