791b17dfbc7f209f7bc186670786d1e33e388972775a936a605fa1c1e9f48c9c

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:20

Target

4fcad8f0fed12c31aefef1141d768763.dll
Size

157KB
MD5

4fcad8f0fed12c31aefef1141d768763
SHA1

476f1264ce28e2927a971b95b40c6f3442119867
SHA256

791b17dfbc7f209f7bc186670786d1e33e388972775a936a605fa1c1e9f48c9c
SHA512

7f937d30ffcfbbf473e8682fd120c654907a887b747dba2a7058cd39956a78e9a6ad80a5594f62a92b7503570c1313eb403582e1f1677f7d73087b1f3f356666
SSDEEP

3072:MBl94wLNOc4AGJOV82EclA5HodonoQkzlYEhxFyVU75cThliJ:MBFZTlATvkzeE8275cTiJ

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4fcad8f0fed12c31aefef1141d768763.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 760	2660	regsvr32.exe	28
PID 2660 wrote to memory of 760	2660	regsvr32.exe	28
PID 2660 wrote to memory of 760	2660	regsvr32.exe	28
PID 2660 wrote to memory of 760	2660	regsvr32.exe	28
PID 2660 wrote to memory of 760	2660	regsvr32.exe	28
PID 2660 wrote to memory of 760	2660	regsvr32.exe	28
PID 2660 wrote to memory of 760	2660	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4fcad8f0fed12c31aefef1141d768763.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4fcad8f0fed12c31aefef1141d768763.dll
  2⤵
  - Modifies registry class
  PID:760