c2e71baefc4efbdb667f3a5c153be3d3d2521d4b856f5381a96a6a272bc21ee8

Analysis

max time kernel
151s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 14:25

Target

python-3.11.2-amd64/pres/ind/app/ProvProvider.dll
Size

753KB
MD5

70c34975e700a9d7e120aaecf9d8f14b
SHA1

e24d47f025c0ec0f60ec187bfc664e9347dc2c9c
SHA256

a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
SHA512

7f6a24345f5724d710e0b6c23b3b251e96d656fac58ea67b2b84d7d9a38d7723eae2c278e6e218e7f69f79d1cce240d91a8b0fd0d99960cacc65d82eb614a260
SSDEEP

12288:X/ck9AStILSQfhJI1UOAibcu978/ftYEGVRU8rbcgWte6QP:PckaLSQpJI1UeUKEKFfetTQP

Score

1^/10

Modifies registry class 10 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\python-3.11.2-amd64\\pres\\ind\\app\\ProvProvider.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\python-3.11.2-amd64\\pres\\ind\\app"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA5B977F-CA5D-483B-81C1-2704C2059C25}\1.0\ = "ProvisioningManager Type Library"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\python-3.11.2-amd64\pres\ind\app\ProvProvider.dll
1⤵
- Modifies registry class
PID:1228