6715c0eff16eb7fb62b4e3c5f355b0548c695e5b12705a731a9abb4f8c7fef31

Analysis

max time kernel
115s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 13:25

Target
data/App/x64/ASIO4ALL v2/asio4all.dll
Size 115KB
Sample221024-qn7eyagge3
SHA256 f53f755e8ae24f9e6d1b925bf32702cf4bd0a92511f87d6c3503830a1fbef9da
MD5 de9b771e11a5800254354124e16856ee
SHA1 d86ec1217077f65bdae1bc207ba16ad5ed98feaf
SHA512 ea0c022843997c05d9d542479dc8c32e6df9bb0e936b1d3e12aeba3ee46b45cee059e640bc0fa777535befc1cfb9d08cddfc32c6090999c19a4171cf479ababd
SSDEEP 1536:ZvzplGOrgSF1HpH01/n8Cx3TzN9CVmkcu32hl:xJjeRDu32
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\ = "ASIO4ALL v2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\data\\App\\x64\\ASIO4ALL v2\\asio4all.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 112	4196	regsvr32.exe	81
PID 4196 wrote to memory of 112	4196	regsvr32.exe	81
PID 4196 wrote to memory of 112	4196	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\data\App\x64\ASIO4ALL v2\asio4all.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\data\App\x64\ASIO4ALL v2\asio4all.dll"
  2⤵
  - Modifies registry class
  PID:112