3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01/07/2023, 21:57

Target

3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
Size

391KB
MD5

1fe5472c751356df0c20f05cad59509d
SHA1

2877b8711537e19b175c6fdc518b75a592245c3e
SHA256

3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd
SHA512

9324b969511970103c3d2fc00c379972a087db37c913b5d01a0685e1945d819e2ace530b744708ee6d6ed60872f359675768d6c0b59498257d73717c5b1cb6a2
SSDEEP

12288:yvO+MmUf61QCCt4oAtxRxp0zUOA1sUZb7m0PG6K:yv3MmUf6WCc4orQOA1sUZb7m0PrK

Score

1^/10

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\ = "zShut"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2032	2012	regsvr32.exe	28
PID 2012 wrote to memory of 2032	2012	regsvr32.exe	28
PID 2012 wrote to memory of 2032	2012	regsvr32.exe	28
PID 2012 wrote to memory of 2032	2012	regsvr32.exe	28
PID 2012 wrote to memory of 2032	2012	regsvr32.exe	28
PID 2012 wrote to memory of 2032	2012	regsvr32.exe	28
PID 2012 wrote to memory of 2032	2012	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
  2⤵
  - Modifies registry class
  PID:2032