df8de06eb63f9800318d31c868750be26f5bb8dce4b9661e2d6d17d3c910b408

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df8de06eb63f9800318d31c868750be26f5bb8dce4b9661e2d6d17d3c910b408.dll
Size

398KB
MD5

4dd0c670acf54e3d9fefd9f1a544ba3b
SHA1

076fe8111a85f2f8674face9ac6774622b3900a7
SHA256

df8de06eb63f9800318d31c868750be26f5bb8dce4b9661e2d6d17d3c910b408
SHA512

72d5fa1bd98261057be3d7fb6864482b5c8f8ec1b718ff930715228147d4bb9542c12213e7b1f64953500046766b71f327f547b29006789fa8ca6d516e4ffb0a
SSDEEP

6144:kJd1l/4+y7maNb33YW9vFzUOwGJA9Kx6Jn:kJdD/477ndlv2

Score

1^/10

Malware Config

Signatures

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ = "IAccessible"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\NumMethods\ = "28"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\ = "{03022430-ABC4-11D0-BDE2-00AA001A1953}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\ = "{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2112	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2112	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2112	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2112	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2112	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2112	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2112	2444	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\df8de06eb63f9800318d31c868750be26f5bb8dce4b9661e2d6d17d3c910b408.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\df8de06eb63f9800318d31c868750be26f5bb8dce4b9661e2d6d17d3c910b408.dll
  2⤵
  - Modifies registry class
  PID:2112

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads