26ebd7f5313753e226fe120a23e0ed1f15220833cd4deba6c55eb7a0c95b3e4d

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05-10-2023 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26ebd7f5313753e226fe120a23e0ed1f15220833cd4deba6c55eb7a0c95b3e4d.dll
Size

260KB
MD5

3c7242e0fb35b7923f2648541edd78aa
SHA1

1d04ce8ab4e7d209a804f3ad2864391d8f1d318c
SHA256

26ebd7f5313753e226fe120a23e0ed1f15220833cd4deba6c55eb7a0c95b3e4d
SHA512

6b94080abe2303e9caff24b5ae0f6f16ceec1068e712bbdb9a765e79ca310b5e2835216fb2d321dd86066d647f041730f3fc8ba61ab053630fedd4ff69d103da
SSDEEP

3072:eluSO1EfMJB+Ns0wkyUAk679tOQffLQfjYibuxXpL3D1M5IrDeL0pp58FxS9:OuSOu0JB+N2vUb67tMIZ

Score

1^/10

Malware Config

Signatures

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020021-0000-0000-C000-000000000046}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020021-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020020-0000-0000-C000-000000000046}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020000-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000D-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020020-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020001-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020001-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020003-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020003-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000D-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020000-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000F-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000F-0000-0000-C000-000000000046}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2840	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2840	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2840	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2840	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2840	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2840	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2840	2980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\26ebd7f5313753e226fe120a23e0ed1f15220833cd4deba6c55eb7a0c95b3e4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\26ebd7f5313753e226fe120a23e0ed1f15220833cd4deba6c55eb7a0c95b3e4d.dll
  2⤵
  - Modifies registry class
  PID:2840

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads