6b629f24fd02c1340d1b64c527fa43b40171869a6bc4c5d3b8daf8a6ca9d12d9

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 22:41

Target

6b629f24fd02c1340d1b64c527fa43b40171869a6bc4c5d3b8daf8a6ca9d12d9.dll
Size

232KB
MD5

b57c69e716cb83f67e5a945e907f7151
SHA1

911db0e51fda7da365f6aa5b547c6679f63b20a8
SHA256

6b629f24fd02c1340d1b64c527fa43b40171869a6bc4c5d3b8daf8a6ca9d12d9
SHA512

a038b96f9642f23d5ff361c1c14f8ebd805f05416abcd378c5955bfe40848e2ab9ebad244b94a7bb4a9ace75b98182237c0c4559ff682302155e012ad2fa1dc5
SSDEEP

1536:/YFqYtU1rlB9hVp+vXfCDC0NyvVcr1z/7HAMkkOqz2pVs78v3vRlXEJNkrftooJl:AqYtU1539+PfCDBNyvQ8YQftooJ7J

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\ = "¾Í 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F911F53A-4254-432F-B1DF-CEA8AFDECE24}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6b629f24fd02c1340d1b64c527fa43b40171869a6bc4c5d3b8daf8a6ca9d12d9.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6b629f24fd02c1340d1b64c527fa43b40171869a6bc4c5d3b8daf8a6ca9d12d9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6b629f24fd02c1340d1b64c527fa43b40171869a6bc4c5d3b8daf8a6ca9d12d9.dll
  2⤵
  - Modifies registry class
  PID:1988

memory/1048-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download
memory/1988-56-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download