f0c266113f9b13300794d051558778c0e61b375e4ded28dd377eb42b920353df

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/06/2023, 20:06

Target

f0c266113f9b13300794d051558778c0e61b375e4ded28dd377eb42b920353df.dll
Size

232KB
MD5

9529a9b39f2e711165606da50b33e090
SHA1

0e9a46007e92b26bc8d9310cbe1ea4dcf8b4ddff
SHA256

f0c266113f9b13300794d051558778c0e61b375e4ded28dd377eb42b920353df
SHA512

537fb3026dc2de87f8b7c610abf4fcf48115b1c23642315fefa25970a53d4607daf319f7c27d6e9732f17ede3727684fb717051dc3e0ab7ec097088204f5f2ee
SSDEEP

1536:p4TNTPlz9BtJNpOvXfCDC0NyfNErV2/7/AMkkOqz2pVs78vHfZlXeJNkr2oSkCI5:wNDlpn9OPfCDBNyfAFuQ2oS65

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\ = "1 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f0c266113f9b13300794d051558778c0e61b375e4ded28dd377eb42b920353df.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A908DF43-151A-4751-A57B-F13A9EDB3303}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1176	836	regsvr32.exe	28
PID 836 wrote to memory of 1176	836	regsvr32.exe	28
PID 836 wrote to memory of 1176	836	regsvr32.exe	28
PID 836 wrote to memory of 1176	836	regsvr32.exe	28
PID 836 wrote to memory of 1176	836	regsvr32.exe	28
PID 836 wrote to memory of 1176	836	regsvr32.exe	28
PID 836 wrote to memory of 1176	836	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f0c266113f9b13300794d051558778c0e61b375e4ded28dd377eb42b920353df.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f0c266113f9b13300794d051558778c0e61b375e4ded28dd377eb42b920353df.dll
  2⤵
  - Modifies registry class
  PID:1176