c8ac08ab3e52c762dd604023fecba1b1bd9f2f9df55261ae918742a11c9e81d6

Analysis

max time kernel
35s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 20:54

Target

c8ac08ab3e52c762dd604023fecba1b1bd9f2f9df55261ae918742a11c9e81d6.dll
Size

68KB
MD5

84585bf5bfe629bd4ccce43efc2b7277
SHA1

8bf7566b686b9238f11d674971668ddf4936e5be
SHA256

c8ac08ab3e52c762dd604023fecba1b1bd9f2f9df55261ae918742a11c9e81d6
SHA512

3e129aab91e6dfd52b65a4d0a5992c3ba72f54d1a8572cfbc402d6eb27f7e645985395b04e72443f0f1a1d76d09bb7de647b6043425d2ca28cda6929fa5bd3b4
SSDEEP

768:06N7Qc/NiZdyl5I42VbxUzITy8jq7JJwylru0OWZ2Un/U9YGoOlRLMng:06JQcc+uFUzITyX7jwylh1v6HlxMng

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c8ac08ab3e52c762dd604023fecba1b1bd9f2f9df55261ae918742a11c9e81d6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\ = "midstat 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EED0534-43F0-412F-89C9-14B39EF2E883}\1.0\0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1176	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1176	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1176	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1176	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1176	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1176	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1176	1944	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c8ac08ab3e52c762dd604023fecba1b1bd9f2f9df55261ae918742a11c9e81d6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c8ac08ab3e52c762dd604023fecba1b1bd9f2f9df55261ae918742a11c9e81d6.dll
  2⤵
  - Modifies registry class
  PID:1176

memory/1176-55-0x0000000000000000-mapping.dmp

Download
memory/1176-56-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1944-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download