1d959a3e8f84550fe62cae486ef0e0ae22bc46ab3bb596ce9238a9dbb484543d

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c43206c357596d16defbfb305048ebd.dll
Size

372KB
MD5

4c43206c357596d16defbfb305048ebd
SHA1

9f5b9d914422a09ed93e2f57faca13a82727c0e4
SHA256

1d959a3e8f84550fe62cae486ef0e0ae22bc46ab3bb596ce9238a9dbb484543d
SHA512

cee0e6901918952ff90dee97e2f96e111842f704d28ece977a72cdf579f3fcbae911b97e0cd01a996adb990a8bbfddd82f3e6ef6bc643223bce5b00859cbb917
SSDEEP

6144:evFniwBPbODv9vJM3WK7xew6Ya9lpu+kxy8wTTCq9FLtkU/D5V4nUaWUQQ:Wi2Ob7lpu+kxybHCAFLtR/D5WUa

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\TypeLib\ = "{0FD6472B-9B97-46C8-9131-6C41811E8D24}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pkoy.clsPkoy	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pkoy.clsPkoy\ = "Pkoy.clsPkoy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4c43206c357596d16defbfb305048ebd.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ = "_clsPkoy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4c43206c357596d16defbfb305048ebd.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\ = "Pkoy.clsPkoy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\TypeLib\ = "{0FD6472B-9B97-46C8-9131-6C41811E8D24}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ = "clsPkoy"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\ProgID\ = "Pkoy.clsPkoy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pkoy.clsPkoy\Clsid\ = "{3324B89D-4908-44C7-ABC2-E95812803897}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\ = "Pkoy"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{0FD6472B-9B97-46C8-9131-6C41811E8D24}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ = "_clsPkoy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pkoy.clsPkoy\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4589588-C805-4C1D-B917-9378C26427FE}\TypeLib\ = "{0FD6472B-9B97-46C8-9131-6C41811E8D24}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3324B89D-4908-44C7-ABC2-E95812803897}\Programmable	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2064	2672	regsvr32.exe	28
PID 2672 wrote to memory of 2064	2672	regsvr32.exe	28
PID 2672 wrote to memory of 2064	2672	regsvr32.exe	28
PID 2672 wrote to memory of 2064	2672	regsvr32.exe	28
PID 2672 wrote to memory of 2064	2672	regsvr32.exe	28
PID 2672 wrote to memory of 2064	2672	regsvr32.exe	28
PID 2672 wrote to memory of 2064	2672	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4c43206c357596d16defbfb305048ebd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4c43206c357596d16defbfb305048ebd.dll
  2⤵
  - Modifies registry class
  PID:2064

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads