b28381f4861b7b66c12744a7aac206abcee131a66584771f1c3369c6c87d3dc4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:00

Target

108d5846df3b006653d8b39a1547d6d6.dll
Size

84KB
MD5

108d5846df3b006653d8b39a1547d6d6
SHA1

4f25d2faf6c18c480bdf5b71e31b77186aa4ca02
SHA256

b28381f4861b7b66c12744a7aac206abcee131a66584771f1c3369c6c87d3dc4
SHA512

d817110cad7d12de0e9060031259d5c8ff16dd8559f8b78f16729a99f7601f4e577bdb4d59124577fd1c986d6978ff9cce51e1dbc974dbb6cd6f1ed285375c19
SSDEEP

1536:OCNbqBJfinjU+UQDM+qLXx0WuzvZHh2OFcosrX/+3a:rIfijeQQLKhZIOFcosrX/+3a

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\108d5846df3b006653d8b39a1547d6d6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2528	2140	regsvr32.exe	14
PID 2140 wrote to memory of 2528	2140	regsvr32.exe	14
PID 2140 wrote to memory of 2528	2140	regsvr32.exe	14
PID 2140 wrote to memory of 2528	2140	regsvr32.exe	14
PID 2140 wrote to memory of 2528	2140	regsvr32.exe	14
PID 2140 wrote to memory of 2528	2140	regsvr32.exe	14
PID 2140 wrote to memory of 2528	2140	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\108d5846df3b006653d8b39a1547d6d6.dll
1⤵
- Modifies registry class
PID:2528

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\108d5846df3b006653d8b39a1547d6d6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2140