6b2cc93b90df494b04e335c2af1f0d77131bb4fc5dda6e6b994aaa29c74fd319

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416ef1cfa32d3478860cd888a2c95f10.dll
Size

186KB
MD5

416ef1cfa32d3478860cd888a2c95f10
SHA1

41adc6292f0b413389de9f6a069a3a46dbf6639b
SHA256

6b2cc93b90df494b04e335c2af1f0d77131bb4fc5dda6e6b994aaa29c74fd319
SHA512

b721e7e7820c928407e0349889fb19904b8ff10a4a4862c38f9dbba23407b20842e95f094e4052b277f6115c993e8f3285a61330c9c936a2197e2ec95b040c00
SSDEEP

3072:KMWJLOm80sjbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7JRkvljmMQfQEhj:KP181/wvP6bQ7yMP+DE827JRkvljlDEt

Score

1^/10

Malware Config

Signatures

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\416ef1cfa32d3478860cd888a2c95f10.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3492	4556	regsvr32.exe	16
PID 4556 wrote to memory of 3492	4556	regsvr32.exe	16
PID 4556 wrote to memory of 3492	4556	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\416ef1cfa32d3478860cd888a2c95f10.dll
1⤵
- Modifies registry class
PID:3492

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\416ef1cfa32d3478860cd888a2c95f10.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/3492-3-0x0000000000590000-0x0000000000593000-memory.dmp

Filesize
12KB

Download
memory/3492-14-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/3492-13-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3492-12-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3492-11-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3492-10-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3492-9-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/3492-8-0x0000000002020000-0x0000000002021000-memory.dmp

Filesize
4KB

Download
memory/3492-7-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3492-6-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/3492-5-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/3492-4-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/3492-2-0x0000000001F60000-0x0000000001F90000-memory.dmp

Filesize
192KB

Download
memory/3492-1-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads