f2b8b9eb433b36caeaff5a15a4c307a7535f173b7d975cfd5b831d4f7a49ade0

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2023 10:42

Target

f2b8b9eb433b36caeaff5a15a4c307a7535f173b7d975cfd5b831d4f7a49ade0.dll
Size

847KB
MD5

bca24e87e020fc7f6853823e750257cc
SHA1

366b80faf850f018b719fabf99e14a66b8af54c4
SHA256

f2b8b9eb433b36caeaff5a15a4c307a7535f173b7d975cfd5b831d4f7a49ade0
SHA512

88da0bec794ee156664be35cf9c25ec5caf0a0333c3b9790f180b871532730311f9ac0c0e6faea6b0478f778a0fa63edd00ca86ddf9302f1b3fcb350947af554
SSDEEP

24576:lgXYaFro7oEIMJk+8R8uX+ob2NrqzZvcO:WoIMJk+8Rfuob2NrqzWO

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f2b8b9eb433b36caeaff5a15a4c307a7535f173b7d975cfd5b831d4f7a49ade0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\ = "Weasel"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1460	5060	regsvr32.exe	84
PID 5060 wrote to memory of 1460	5060	regsvr32.exe	84
PID 5060 wrote to memory of 1460	5060	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f2b8b9eb433b36caeaff5a15a4c307a7535f173b7d975cfd5b831d4f7a49ade0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f2b8b9eb433b36caeaff5a15a4c307a7535f173b7d975cfd5b831d4f7a49ade0.dll
  2⤵
  - Modifies registry class
  PID:1460