c071758b1b39c913cdeb6ffd090e21b21744d01298290ea4c0e2538f94188cc0

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bb6c0ee588752d041c102da3f226011.dll
Size

182KB
MD5

4bb6c0ee588752d041c102da3f226011
SHA1

1a36fbe61e382208ac69f4caa69d4c2f2345774b
SHA256

c071758b1b39c913cdeb6ffd090e21b21744d01298290ea4c0e2538f94188cc0
SHA512

e66655961bf9c5e61d97d1b3f08d26f6e3b168df93e7cd8e84f48c970adafae38c10c9134228b74e3b2b70f72df6c618dd227fa73a5728c3ade7271ec7670c2f
SSDEEP

3072:AdCqGZWIwA1fKqOiRbXrWn3bbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7DA:aIZW613ynLwvP6bQ7yMP+DE827DgV

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	4404	WerFault.exe	88

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\ = "loader 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\loader.DLL\AppID = "{D103EBF9-6DD5-4715-863A-00AA27C7935A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D103EBF9-6DD5-4715-863A-00AA27C7935A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\loader.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4bb6c0ee588752d041c102da3f226011.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C85E2990-D4B6-44F5-A323-ED943493F8DF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D103EBF9-6DD5-4715-863A-00AA27C7935A}\ = "loader"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4404	1372	regsvr32.exe	88
PID 1372 wrote to memory of 4404	1372	regsvr32.exe	88
PID 1372 wrote to memory of 4404	1372	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4bb6c0ee588752d041c102da3f226011.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4bb6c0ee588752d041c102da3f226011.dll
  2⤵
  - Modifies registry class
  PID:4404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 640
    3⤵
    - Program crash
    PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4404 -ip 4404
1⤵
PID:3932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4404-0-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/4404-1-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/4404-40-0x00000000030A0000-0x00000000030A1000-memory.dmp

Filesize
4KB

Download
memory/4404-63-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/4404-62-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4404-61-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/4404-60-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/4404-59-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/4404-58-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/4404-56-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/4404-57-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/4404-55-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/4404-54-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/4404-53-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/4404-52-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/4404-51-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/4404-50-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/4404-49-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/4404-48-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/4404-47-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/4404-46-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/4404-45-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/4404-44-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/4404-43-0x00000000030B0000-0x00000000030B1000-memory.dmp

Filesize
4KB

Download
memory/4404-42-0x00000000030C0000-0x00000000030C1000-memory.dmp

Filesize
4KB

Download
memory/4404-41-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/4404-39-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/4404-38-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/4404-37-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/4404-36-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/4404-35-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/4404-34-0x0000000003030000-0x0000000003031000-memory.dmp

Filesize
4KB

Download
memory/4404-33-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/4404-32-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/4404-31-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/4404-30-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/4404-29-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

Filesize
4KB

Download
memory/4404-28-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/4404-27-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/4404-26-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4404-25-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/4404-24-0x0000000002F90000-0x0000000002F91000-memory.dmp

Filesize
4KB

Download
memory/4404-23-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/4404-22-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download
memory/4404-21-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/4404-20-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/4404-19-0x0000000002F20000-0x0000000002F21000-memory.dmp

Filesize
4KB

Download
memory/4404-18-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/4404-17-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/4404-16-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/4404-15-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/4404-14-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Filesize
4KB

Download
memory/4404-13-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/4404-12-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Filesize
4KB

Download
memory/4404-11-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/4404-10-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/4404-9-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/4404-8-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/4404-7-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/4404-6-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/4404-5-0x0000000001340000-0x0000000001341000-memory.dmp

Filesize
4KB

Download
memory/4404-4-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/4404-3-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Filesize
4KB

Download
memory/4404-2-0x0000000002CB0000-0x0000000002CE0000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads