dee47e733e8ef6a2578ec7472b713b3809f866c1a04987478735c6212e2641a3

Analysis

max time kernel
146s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 19:05

Target

01372e179046b4d53e1cb527d3624fd8.dll
Size

92KB
MD5

01372e179046b4d53e1cb527d3624fd8
SHA1

c0ab5c1ad5c0588f11f85c0655add4f74b31008f
SHA256

dee47e733e8ef6a2578ec7472b713b3809f866c1a04987478735c6212e2641a3
SHA512

62e93713cb5734d840cf2eb5e763f077a3b76dac8b4a084588ddbd9b5884f15008c886d8a5e8e60fb7b42d2862fa9e91c9863fb975a39d618d105b2e9ad40ebf
SSDEEP

1536:b/btf08xbpkLslQjvadsyBwjvCohdoEpVna1Lg+T7D:jV08/kolpdXsRdoEpVna1Hb

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\01372e179046b4d53e1cb527d3624fd8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4884	392	regsvr32.exe	15
PID 392 wrote to memory of 4884	392	regsvr32.exe	15
PID 392 wrote to memory of 4884	392	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\01372e179046b4d53e1cb527d3624fd8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\01372e179046b4d53e1cb527d3624fd8.dll
  2⤵
  - Modifies registry class
  PID:4884