b501a9a483b5f6edf4fcaf7ecddd12971f11234a57b39ffe488461afdf39f491 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 01:47

Sharing

Report Analysis Logs

General

Target

7bd57a05c0171540d12531eda89b8fbb.dll
Size

18KB
MD5

7bd57a05c0171540d12531eda89b8fbb
SHA1

18ffa514f84cf37e1e6251df7cdb6bcefa423d9a
SHA256

b501a9a483b5f6edf4fcaf7ecddd12971f11234a57b39ffe488461afdf39f491
SHA512

392095bf185fe17c75668aa44c248650456ef2d2deeb5de56a9cfb7855045fd085fc3c16d1afd7a1032bb4ecc04fe6acc0ebad4efdb88be61b0d2a1aff46cef0
SSDEEP

384:dm0DDDPk9VGCOOVM4jh5EQKl+0fkfsyZ:EOXnCOGnjh5Gkfsy

Score

1^/10

Malware Config

Signatures

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7bd57a05c0171540d12531eda89b8fbb.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2376	1984	regsvr32.exe	28
PID 1984 wrote to memory of 2376	1984	regsvr32.exe	28
PID 1984 wrote to memory of 2376	1984	regsvr32.exe	28
PID 1984 wrote to memory of 2376	1984	regsvr32.exe	28
PID 1984 wrote to memory of 2376	1984	regsvr32.exe	28
PID 1984 wrote to memory of 2376	1984	regsvr32.exe	28
PID 1984 wrote to memory of 2376	1984	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7bd57a05c0171540d12531eda89b8fbb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7bd57a05c0171540d12531eda89b8fbb.dll
  2⤵
  - Modifies registry class
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads