bf200bf3542bd22b41d5ef1a8bf8ef77390e05abaee23aac48da1acd3dca4aff | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 02:33

Sharing

Report Analysis Logs

General

Target

0029d7dc9c00caf792ad9ae2b3518a1b.dll
Size

37KB
MD5

0029d7dc9c00caf792ad9ae2b3518a1b
SHA1

7f1c0502e6b05ff985e4ec284b3de5fcfae4891f
SHA256

bf200bf3542bd22b41d5ef1a8bf8ef77390e05abaee23aac48da1acd3dca4aff
SHA512

8ac58dd5245e6ce33efaf1d0132d66b477a426197b38653c514312da71a10ca1d9bd9674fb490ef94195a3d5e13e0dd72d14996e9c2f3f103ca7363a2bd5aaf1
SSDEEP

768:vPByKN84xZ36DSErHtkBwJOiV4dnzEwnYJ:HdNTOD5EwJ5sEmu

Score

1^/10

Malware Config

Signatures

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0029D7~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\ = "netsflt Driver Configuration Notify Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\ = "netsflt Notify 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0029d7dc9c00caf792ad9ae2b3518a1b.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 728	4856	regsvr32.exe	89
PID 4856 wrote to memory of 728	4856	regsvr32.exe	89
PID 4856 wrote to memory of 728	4856	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0029d7dc9c00caf792ad9ae2b3518a1b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0029d7dc9c00caf792ad9ae2b3518a1b.dll
  2⤵
  - Modifies registry class
  PID:728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads