b8ee99722fd55e7556cc792a8b5581e2029c499c388e473d1a36dc94a7eceaa2

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:35

Target

b8ee99722fd55e7556cc792a8b5581e2029c499c388e473d1a36dc94a7eceaa2.dll
Size

610KB
MD5

d71827b5461e33472c7ae50e6fed22f0
SHA1

792025448e02fce1157dc247ef98dcccfc75f089
SHA256

b8ee99722fd55e7556cc792a8b5581e2029c499c388e473d1a36dc94a7eceaa2
SHA512

a6e1d392c5b2eabc08e9686828c6c2fe40aa56685fba857b2ae5fe7b03037e702e88f44e0a910f5095b212f597b0dedc618b29118a78333433fa5e79eafa92b7
SSDEEP

12288:FJGHFCXyI+vkdZTdLTctwbLwpJVh1EQiW7kBdYiDM:FQluyIVvdy+LwB1pgdYiD

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b8ee99722fd55e7556cc792a8b5581e2029c499c388e473d1a36dc94a7eceaa2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1780	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1780	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1780	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1780	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1780	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1780	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1780	1792	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b8ee99722fd55e7556cc792a8b5581e2029c499c388e473d1a36dc94a7eceaa2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b8ee99722fd55e7556cc792a8b5581e2029c499c388e473d1a36dc94a7eceaa2.dll
  2⤵
  - Modifies registry class
  PID:1780

memory/1780-56-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1780-57-0x0000000001EB0000-0x0000000001F4E000-memory.dmp

Filesize
632KB

Download
memory/1792-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download