3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd

Analysis

max time kernel
123s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2023 21:57

Target

3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
Size

391KB
MD5

1fe5472c751356df0c20f05cad59509d
SHA1

2877b8711537e19b175c6fdc518b75a592245c3e
SHA256

3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd
SHA512

9324b969511970103c3d2fc00c379972a087db37c913b5d01a0685e1945d819e2ace530b744708ee6d6ed60872f359675768d6c0b59498257d73717c5b1cb6a2
SSDEEP

12288:yvO+MmUf61QCCt4oAtxRxp0zUOA1sUZb7m0PG6K:yv3MmUf6WCc4orQOA1sUZb7m0PrK

Score

5^/10

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{ECBB156A-82F1-4049-B5F6-A29D34C41759}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{97F1E0F5-5CA0-4A55-84E7-916924D6501A}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0D1F3567-8B58-4A43-A1EF-F5051CA40582}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{01266235-24DF-45DA-BDAC-E57BDBFF98B2}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7E184DF3-40F6-4322-9CB9-D16618223C5F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5210FAFF-0213-47D5-983F-0E1CC57D5DA1}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{64F32D42-DF16-4C33-9016-D76FD7B2F7A4}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9241DD39-F988-459D-8B5F-D6169FBC0C6E}.catalogItem	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\ = "zShut"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2528	3884	regsvr32.exe	83
PID 3884 wrote to memory of 2528	3884	regsvr32.exe	83
PID 3884 wrote to memory of 2528	3884	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
  2⤵
  - Modifies registry class
  PID:2528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:1192