daf3fdc87831e6c0f4aa59c08efe241188cf7dfe92c2fa889b299f93e88531b1

Analysis

max time kernel
161s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 16:53

Target
daf3fdc87831e6c0f4aa59c08efe241188cf7dfe92c2fa889b299f93e88531b1.dll
Size 52KB
Sample221201-vd5ktacf3v
SHA256 daf3fdc87831e6c0f4aa59c08efe241188cf7dfe92c2fa889b299f93e88531b1
MD5 8aa3eace1329ef399bb20822c1c179ef
SHA1 0e77bfe9967e094d990b23e0f91ef3e516e95eae
SHA512 6f923864e875c32de52330c1f69aa1b6979234f2a5561248325726a0fd912bdaddf5549acbc71519af3fd314e68ce97bc5a120726a4d47e569442155010eab48
SSDEEP 768:txyE7l5DqKG8pNRvAILgvZnhydzQaOE40VwM0KzzdkFXSvt9V+99bplgyMYy7fim:tMgDxjpXAISH8Qy16BA19u9bjaRmdL
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ï ®‰Ä÷â‰5	regsvr32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\›"=Ð¬¤µñ«nàC]•\½üšË¢‚ æ”’éì€AÌ{v®K•1åª½ßÆ«ù[ k¯A1×± ÒÆ²Pà`u²V–7E\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\daf3fdc87831e6c0f4aa59c08efe241188cf7dfe92c2fa889b299f93e88531b1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ì#Šµ¤àæ\ = "ê[\rÕÝ›¢’Ž\x1d\x14ç‘†ôá’QíK2Vá"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ã,¢…æ	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ã,¢…æ\…+7ßšâ’” ñ‹—ðíÕOîSwË3æVS•‚î—Âý’PúI$$ = "”\x11\nñ‹—ðíÕOîSw\x13Ë3æVS•‚\x1d\x1fî\u009d—Âý’PúI$$"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ã,¢…æ\ = "‚\v\x1eâµ‚èò²SüCB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\›"=Ð¬¤µñ«nàC]•	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ì#Šµ¤àæ	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ã,¢…æ\ = "¢\x0f\x03ÿ‚\u009dú¥šBë\x16s\nÆ6Ñ"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\›"=Ð¬¤µñ«nàC]•\½üšË¢‚ æ”’éì€AÌ{v®K•1åª½ßÆ«ù[ k¯A1×± ÒÆ²Pà`u²V–7E	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4336	4724	regsvr32.exe	80
PID 4724 wrote to memory of 4336	4724	regsvr32.exe	80
PID 4724 wrote to memory of 4336	4724	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\daf3fdc87831e6c0f4aa59c08efe241188cf7dfe92c2fa889b299f93e88531b1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\daf3fdc87831e6c0f4aa59c08efe241188cf7dfe92c2fa889b299f93e88531b1.dll
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  PID:4336