44c11de779d4578f06d465b4547c83f55a30751ced704e3a3cef983cb2ad3825

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

887dff2727fb37b6916f56c21cd89bbb.dll
Size

112KB
MD5

887dff2727fb37b6916f56c21cd89bbb
SHA1

f8f4dbae4f746d97e2f79cd9390d265211f81323
SHA256

44c11de779d4578f06d465b4547c83f55a30751ced704e3a3cef983cb2ad3825
SHA512

b66c2d6b49ce73f6ef7841dd4b8af44d35b58ab9c1b055f47e82b43f80fb4f589c16bbf79b20a647566a7ccfa776391feb1be7cadfbea6d061cb3c93b8bef94b
SSDEEP

1536:r98XpDNOMLK0rlRNC9o8o+ZsJWbmRlF4MApPZmFUp7X67MhVwARa+bO1z:r9O9RNCHZsJWbmRlF4MAJsFUp7XX

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DvDgComVolCliL.ClsComVolCliL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\ = "DvDgComVolCliL.ClsComVolCliL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\ = "Dv Datages Comercial Volumen de Clientes Listado"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\ProgID\ = "DvDgComVolCliL.ClsComVolCliL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DvDgComVolCliL.ClsComVolCliL\Clsid\ = "{78DA0720-E62F-4DCE-9931-98606E0A801D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\887dff2727fb37b6916f56c21cd89bbb.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DvDgComVolCliL.ClsComVolCliL\ = "DvDgComVolCliL.ClsComVolCliL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ = "ClsComVolCliL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\887dff2727fb37b6916f56c21cd89bbb.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\TypeLib\ = "{CA5E511E-60E1-4AB4-9F42-0F971198524C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ = "_ClsComVolCliL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\ = "_ClsComVolCliL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\TypeLib\ = "{CA5E511E-60E1-4AB4-9F42-0F971198524C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DvDgComVolCliL.ClsComVolCliL\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CA5E511E-60E1-4AB4-9F42-0F971198524C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B306DF8-4423-4CED-8902-C3B0FA150E76}\TypeLib\ = "{CA5E511E-60E1-4AB4-9F42-0F971198524C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78DA0720-E62F-4DCE-9931-98606E0A801D}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2228	2212	regsvr32.exe	28
PID 2212 wrote to memory of 2228	2212	regsvr32.exe	28
PID 2212 wrote to memory of 2228	2212	regsvr32.exe	28
PID 2212 wrote to memory of 2228	2212	regsvr32.exe	28
PID 2212 wrote to memory of 2228	2212	regsvr32.exe	28
PID 2212 wrote to memory of 2228	2212	regsvr32.exe	28
PID 2212 wrote to memory of 2228	2212	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\887dff2727fb37b6916f56c21cd89bbb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\887dff2727fb37b6916f56c21cd89bbb.dll
  2⤵
  - Modifies registry class
  PID:2228

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads