033de1076f9b8b7ed077f36126241aaa40e7b2dc55031518edd4a40bfb1c419e | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 15:32

Sharing

Report Analysis Logs

General

Target

77ba6b4410ab3f285aae696099f202dc.dll
Size

659KB
MD5

77ba6b4410ab3f285aae696099f202dc
SHA1

8445d905968b17a375bc4e504b8d0090247e5794
SHA256

033de1076f9b8b7ed077f36126241aaa40e7b2dc55031518edd4a40bfb1c419e
SHA512

050e58068611382c2a2d227fbe0b302ef6c84d2e6facacb6ef86a8d962a582c7ebc88348b4389676b279c39c0fcd52570c49421f1a6d3e19ba58dcb35883cbe7
SSDEEP

12288:3U54E7/7TbThJm7ZZZZ1U54E7/7TbThJm:M7/7TW7ZZZZ+7/7TW

Score

1^/10

Malware Config

Signatures

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\77ba6b4410ab3f285aae696099f202dc.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\ = "XACT Engine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2912	2908	regsvr32.exe	17
PID 2908 wrote to memory of 2912	2908	regsvr32.exe	17
PID 2908 wrote to memory of 2912	2908	regsvr32.exe	17
PID 2908 wrote to memory of 2912	2908	regsvr32.exe	17
PID 2908 wrote to memory of 2912	2908	regsvr32.exe	17
PID 2908 wrote to memory of 2912	2908	regsvr32.exe	17
PID 2908 wrote to memory of 2912	2908	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\77ba6b4410ab3f285aae696099f202dc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\77ba6b4410ab3f285aae696099f202dc.dll
  2⤵
  - Modifies registry class
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x00000000003B0000-0x00000000003F5000-memory.dmp

Filesize
276KB

Download