def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:18

Target

Thunder/Program/DllNewTask.dll
Size

481KB
MD5

76df37c492bf44f1f525a29657c582a0
SHA1

c7f5db29f225378ea34ac324c54422fad4293875
SHA256

3c88afda3b7bbe34ace1a6ecd6328f511777070c33f904d0990904c11b0566ce
SHA512

f9df003945a5f9aaa577c64ed869a1c160d3b8e6f5e6d0d3d3eaca1365a154b04d8bd3d6efcdfa9fb8f9dac89d829e6091024ac382424ec20bba026684e863e6
SSDEEP

6144:ELH2PAlCYdLwG9gTDdEhheJOwhFeUQxMkIriOrJCV+kO8Z98:ELH2PAlRdZg7JOwhFhwISVEQ98

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DllNewTask	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58BF919A-608B-44A0-9A99-B25BFE16FE02}\ = "Xunlei.DllNewTask"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DllNewTask\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58BF919A-608B-44A0-9A99-B25BFE16FE02}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58BF919A-608B-44A0-9A99-B25BFE16FE02}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder\\Program\\DLLNEW~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DllNewTask\ = "Xunlei.DllNewTask"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58BF919A-608B-44A0-9A99-B25BFE16FE02}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xunlei.DllNewTask\CLSID\ = "{58BF919A-608B-44A0-9A99-B25BFE16FE02}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58BF919A-608B-44A0-9A99-B25BFE16FE02}\ProgID\ = "Xunlei.DllNewTask"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58BF919A-608B-44A0-9A99-B25BFE16FE02}\InProcServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2016	1172	regsvr32.exe	28
PID 1172 wrote to memory of 2016	1172	regsvr32.exe	28
PID 1172 wrote to memory of 2016	1172	regsvr32.exe	28
PID 1172 wrote to memory of 2016	1172	regsvr32.exe	28
PID 1172 wrote to memory of 2016	1172	regsvr32.exe	28
PID 1172 wrote to memory of 2016	1172	regsvr32.exe	28
PID 1172 wrote to memory of 2016	1172	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Thunder\Program\DllNewTask.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Thunder\Program\DllNewTask.dll
  2⤵
  - Modifies registry class
  PID:2016