a5fb695ac100f0fb1f1b5d2536d5f04021f2a3619a803a7792f5cc415874b057

Analysis

max time kernel
5s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:00

Target

a5fb695ac100f0fb1f1b5d2536d5f04021f2a3619a803a7792f5cc415874b057.dll
Size

53KB
MD5

da2fbf07d1303ee071f4d9243d698456
SHA1

ecc2e03cbbb634ade85e0e58448d096eb3de42a6
SHA256

a5fb695ac100f0fb1f1b5d2536d5f04021f2a3619a803a7792f5cc415874b057
SHA512

d72b641e8c9e2490062e195f7630f06c9d6b61ab1fd4fc393d539f1bd09474d1b29d6018bd0b18b085383a0bce8efe6fc5978815be019fe0c2ac65590b03e2fb
SSDEEP

1536:tgPxr/TmWO5zdP7pdVJdHMW5EAEk/zKhCnM12uAJ2Qnouy8:tiv2zdP7RJdsA5/DBVJ2Yout

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a5fb695ac100f0fb1f1b5d2536d5f04021f2a3619a803a7792f5cc415874b057.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 344	1728	regsvr32.exe	28
PID 1728 wrote to memory of 344	1728	regsvr32.exe	28
PID 1728 wrote to memory of 344	1728	regsvr32.exe	28
PID 1728 wrote to memory of 344	1728	regsvr32.exe	28
PID 1728 wrote to memory of 344	1728	regsvr32.exe	28
PID 1728 wrote to memory of 344	1728	regsvr32.exe	28
PID 1728 wrote to memory of 344	1728	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a5fb695ac100f0fb1f1b5d2536d5f04021f2a3619a803a7792f5cc415874b057.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a5fb695ac100f0fb1f1b5d2536d5f04021f2a3619a803a7792f5cc415874b057.dll
  2⤵
  - Modifies registry class
  PID:344

memory/344-56-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1728-54-0x000007FEFC191000-0x000007FEFC193000-memory.dmp

Filesize
8KB

Download