0354ccb430fe22a115dcb87f77f2e4e0729c0a018de517218d56b75cf3b0255a

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 19:48

Target

3eeb86b70f616bb4b3198aea7d349e00.dll
Size

84KB
MD5

3eeb86b70f616bb4b3198aea7d349e00
SHA1

492b11da3fa23e6c4cd4800a9406660d2088672b
SHA256

0354ccb430fe22a115dcb87f77f2e4e0729c0a018de517218d56b75cf3b0255a
SHA512

83a4f3c0146a540c5e3863102687f93ec4701b5ba8b8ac2260ae561bca683585ff154609fd38a0cb965c2a76b49cc94ddf80569c5541ba3fb210946908c9401b
SSDEEP

1536:PDXqssSO1kVzi46TWGZfHSLt25Avb7NqSFcoszX/+3:rZO1UziDnZfwtRbsSFcoszX/+3

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3eeb86b70f616bb4b3198aea7d349e00.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3eeb86b70f616bb4b3198aea7d349e00.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3eeb86b70f616bb4b3198aea7d349e00.dll
  2⤵
  - Modifies registry class
  PID:2136