bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af

Analysis

max time kernel
163s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 22:52

Target

bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af.dll
Size

666KB
MD5

7a30ae7ceace57524c61eb4c9536c5e5
SHA1

d394c60d6460225e2f2859094a831ba4aff0419d
SHA256

bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af
SHA512

dcd41642342839e5106ee0ba9cabd62c9f071fbeec7014bb4c83f3f0a52bd7a358378436ef8654cca4d1cc1a61cb9c81467b6a27054e81d039fad45935b0b0ea
SSDEEP

3072:JSIiqi3yPXZqueK7BCeGXZ8A9c/ecWqdcsAghV0ezVRxazmNIESdtBwLdft+K9K/:JSID+qiK7BCxOA6/vOEGXUmUcTE223lQ

Score

1^/10

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\ = "MSDAINITIALIZE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DataLinks\ = "DataLinks"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\TypeLib\ = "{2206CEB0-19C1-11D1-89E0-00C04FD7A829}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4216	4104	regsvr32.exe	85
PID 4104 wrote to memory of 4216	4104	regsvr32.exe	85
PID 4104 wrote to memory of 4216	4104	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf8015a7e40236a13fe6b03d92cec7e57bcc82d5e02a4a2af30096e1b201d9af.dll
  2⤵
  - Modifies registry class
  PID:4216