bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af

Analysis

max time kernel
19s
max time network
39s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 22:52

Target

bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af.dll
Size

666KB
MD5

7a30ae7ceace57524c61eb4c9536c5e5
SHA1

d394c60d6460225e2f2859094a831ba4aff0419d
SHA256

bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af
SHA512

dcd41642342839e5106ee0ba9cabd62c9f071fbeec7014bb4c83f3f0a52bd7a358378436ef8654cca4d1cc1a61cb9c81467b6a27054e81d039fad45935b0b0ea
SSDEEP

3072:JSIiqi3yPXZqueK7BCeGXZ8A9c/ecWqdcsAghV0ezVRxazmNIESdtBwLdft+K9K/:JSID+qiK7BCxOA6/vOEGXUmUcTE223lQ

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DataLinks\ = "DataLinks"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2868	2664	regsvr32.exe	30
PID 2664 wrote to memory of 2868	2664	regsvr32.exe	30
PID 2664 wrote to memory of 2868	2664	regsvr32.exe	30
PID 2664 wrote to memory of 2868	2664	regsvr32.exe	30
PID 2664 wrote to memory of 2868	2664	regsvr32.exe	30
PID 2664 wrote to memory of 2868	2664	regsvr32.exe	30
PID 2664 wrote to memory of 2868	2664	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af.dll
  2⤵
  - Modifies registry class
  PID:2868