def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:18

Target

Thunder/Program/ConfigPane.dll
Size

261KB
MD5

5064015e8d17ebdce6e08218554a297c
SHA1

48ee6b15f4ae3396c362f1af015bfeb44210b96c
SHA256

b8a12195ba453bfc13bc80333d75d08d79ce24c47b814725488f64fb98770e01
SHA512

8bc1f5270be5c73c89befe58fea4a45fcf6577f476eb247897565d2e6c0bc6e9649d6c5ae084bd43bce80248460650df4c114ac3b270390f2a4fd98732efa2c8
SSDEEP

3072:mDPiAXA7EYOvOozFmlRdzT09aJsypT8VJSLGlZnYYZjdsqwmOH7YZbJ7EomDr+pz:mfSEYOrQlRdv09aJhVHFu17UwIW

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DLConfigPanel\ = "Xunlei.DLConfigPanel"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{043DFB01-3178-41D3-AA17-B411EF8BB492}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DLConfigPanel\CLSID\ = "{043DFB01-3178-41D3-AA17-B411EF8BB492}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{043DFB01-3178-41D3-AA17-B411EF8BB492}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{043DFB01-3178-41D3-AA17-B411EF8BB492}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder\\Program\\CONFIG~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DLConfigPanel	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{043DFB01-3178-41D3-AA17-B411EF8BB492}\ = "Xunlei.DLConfigPanel"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DLConfigPanel\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{043DFB01-3178-41D3-AA17-B411EF8BB492}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{043DFB01-3178-41D3-AA17-B411EF8BB492}\ProgID\ = "Xunlei.DLConfigPanel"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 796	1568	regsvr32.exe	16
PID 1568 wrote to memory of 796	1568	regsvr32.exe	16
PID 1568 wrote to memory of 796	1568	regsvr32.exe	16
PID 1568 wrote to memory of 796	1568	regsvr32.exe	16
PID 1568 wrote to memory of 796	1568	regsvr32.exe	16
PID 1568 wrote to memory of 796	1568	regsvr32.exe	16
PID 1568 wrote to memory of 796	1568	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Thunder\Program\ConfigPane.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Thunder\Program\ConfigPane.dll
  2⤵
  - Modifies registry class
  PID:796