def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:18

Target

Thunder/Program/BaseIM.dll
Size

209KB
MD5

346ef364638b7a854ccb8f203b97ab81
SHA1

6dfc5ce8a4baeee507c30439702ebe2b68f3a24a
SHA256

3cb182403c60e42fae9e98c0cde52c9d38b524a5fdbbc195009aeb9db42421ce
SHA512

0a5829846053772c657e2b6c8fd54dd6e5ca0906b2f793478a1ca75bbf616f3f94254c4ed48251f95827484ea437486cd2fee800fa72cc9a6c443c1d5752e809
SSDEEP

3072:wQcQ262Ej6IvVrk4t12Lvw832xol170bgAboRF0eydHiLntdRSrZb/8QK:w3ieEpkoQoxo370ye7d8RSly

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8F6F554B-4F07-41FE-B5F1-1C73A4EE30D9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8F6F554B-4F07-41FE-B5F1-1C73A4EE30D9}\ = "BaseIM"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BaseIM.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BaseIM.DLL\AppID = "{8F6F554B-4F07-41FE-B5F1-1C73A4EE30D9}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2388	2728	regsvr32.exe	21
PID 2728 wrote to memory of 2388	2728	regsvr32.exe	21
PID 2728 wrote to memory of 2388	2728	regsvr32.exe	21
PID 2728 wrote to memory of 2388	2728	regsvr32.exe	21
PID 2728 wrote to memory of 2388	2728	regsvr32.exe	21
PID 2728 wrote to memory of 2388	2728	regsvr32.exe	21
PID 2728 wrote to memory of 2388	2728	regsvr32.exe	21

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Thunder\Program\BaseIM.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Thunder\Program\BaseIM.dll
  2⤵
  - Modifies registry class
  PID:2388