ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d

Analysis

max time kernel
172s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 22:36

Target

ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
Size

292KB
MD5

97f5efa288eda2b70388f0900f2fdf35
SHA1

3d3ef1bc1ebbe172de61289c49a95c9dbaba940f
SHA256

ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d
SHA512

2ce182d21052729efb959cc9422943896315e334c73c381c052502c4f04afcf72b5f30bd952abaa5dbe993d270e989fa2ecd484404bc8e24b4f19d89090bf4b9
SSDEEP

6144:135zm5Oysu+wf3Qe1pgT6vH5UUNmBvvaH:13lm5Oy5/fgm6T6RUQiv

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\ = "Zmapi"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4748	4872	regsvr32.exe	82
PID 4872 wrote to memory of 4748	4872	regsvr32.exe	82
PID 4872 wrote to memory of 4748	4872	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
  2⤵
  - Modifies registry class
  PID:4748