b501a9a483b5f6edf4fcaf7ecddd12971f11234a57b39ffe488461afdf39f491 | Triage

Analysis

max time kernel
90s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 01:47

Sharing

Report Analysis Logs

General

Target

7bd57a05c0171540d12531eda89b8fbb.dll
Size

18KB
MD5

7bd57a05c0171540d12531eda89b8fbb
SHA1

18ffa514f84cf37e1e6251df7cdb6bcefa423d9a
SHA256

b501a9a483b5f6edf4fcaf7ecddd12971f11234a57b39ffe488461afdf39f491
SHA512

392095bf185fe17c75668aa44c248650456ef2d2deeb5de56a9cfb7855045fd085fc3c16d1afd7a1032bb4ecc04fe6acc0ebad4efdb88be61b0d2a1aff46cef0
SSDEEP

384:dm0DDDPk9VGCOOVM4jh5EQKl+0fkfsyZ:EOXnCOGnjh5Gkfsy

Score

1^/10

Malware Config

Signatures

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7bd57a05c0171540d12531eda89b8fbb.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1056	4804	regsvr32.exe	84
PID 4804 wrote to memory of 1056	4804	regsvr32.exe	84
PID 4804 wrote to memory of 1056	4804	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7bd57a05c0171540d12531eda89b8fbb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7bd57a05c0171540d12531eda89b8fbb.dll
  2⤵
  - Modifies registry class
  PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads