ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d

Analysis

max time kernel
214s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:36

Target

ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
Size

292KB
MD5

97f5efa288eda2b70388f0900f2fdf35
SHA1

3d3ef1bc1ebbe172de61289c49a95c9dbaba940f
SHA256

ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d
SHA512

2ce182d21052729efb959cc9422943896315e334c73c381c052502c4f04afcf72b5f30bd952abaa5dbe993d270e989fa2ecd484404bc8e24b4f19d89090bf4b9
SSDEEP

6144:135zm5Oysu+wf3Qe1pgT6vH5UUNmBvvaH:13lm5Oy5/fgm6T6RUQiv

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\ = "Zmapi"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS\ = "0"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1180	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1180	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1180	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1180	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1180	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1180	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1180	1516	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
  2⤵
  - Modifies registry class
  PID:1180

memory/1180-56-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download
memory/1516-54-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Filesize
8KB

Download