b380b16401e467d3f57d0fffba1f4e9796c7a2ae500d4ee46db92ee67d4f4eac

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 04:19

Target
4a6bac9bbc085a5cc1365fea8c010bea.dll
Size 18KB
Sample240108-exhmdscaa9
SHA256 b380b16401e467d3f57d0fffba1f4e9796c7a2ae500d4ee46db92ee67d4f4eac
MD5 4a6bac9bbc085a5cc1365fea8c010bea
SHA1 4dbe175eab13b2f87741f94e2fa60297119e1633
SHA512 143010dad06ec2236a65d788a6dd6e1a5458a17266ec54d7cfe45385fa51085626e59b72e40787ce73004623c03f7a3a9152ceabfcf4ed28776006ba405779d0
SSDEEP 192:kBaysi8Xmiikw96wAiSkvRlquHSHKF8l3qenZsxXSvZXDNRRWJsRLMdlO2/:Hi8lysKErY4XDgJIYsu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a6bac9bbc085a5cc1365fea8c010bea.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2648	2556	regsvr32.exe	88
PID 2556 wrote to memory of 2648	2556	regsvr32.exe	88
PID 2556 wrote to memory of 2648	2556	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a6bac9bbc085a5cc1365fea8c010bea.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4a6bac9bbc085a5cc1365fea8c010bea.dll
  2⤵
  - Modifies registry class
  PID:2648