d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll
Size

970KB
MD5

e30383b548beb4a46d59aa5fe7812f0b
SHA1

540df364e3eef3f32ae72695130327e123b0bc61
SHA256

d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2
SHA512

17fd2e91fdb0d8a07afc1231b1abea17e04991c47dfc6e9e51ca0665ba7782dff1f272a7b2babd58504f1b598d4aeb3ad974bb9febd0555773d2dba4376fda76
SSDEEP

3072:OnWTuLHZBAivhm/ooDBcoQvilCUds+fCty4O7RR:OeMHlUQoDmpq4+stk4O7RR

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927E938}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927E938}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF92}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FF92}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927FF92}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927F974}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF94}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FAA4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FCC4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927E938}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FAA4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FDD4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF94}\ = "vMix Video External 2 YV12"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FCC4}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FDD4}\ = "vMix Video External 4 YV12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927F974}\ = "vMix Video External 2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927F974}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927F974}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927F974}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF92}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FBB4}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FBB4}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927FBB4}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FBB4}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FCC4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FCC4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FCC4}\FriendlyName = "vMix Video External 4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927E938}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927E938}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FCC4}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FDD4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FDD4}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF92}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FF92}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FF94}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927FF94}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FDD4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF94}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FF94}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FAA4}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FCC4}\ = "vMix Video External 4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FDD4}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927E938}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927E938}\FriendlyName = "vMix Video"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FBB4}\FriendlyName = "vMix Video External 3 YV12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FDD4}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927FDD4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927F974}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927E938}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FAA4}\ = "vMix Video External 3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FAA4}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927FAA4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FBB4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927F974}\FriendlyName = "vMix Video External 2"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927E938}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF92}\ = "vMix Video YV12"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FBB4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927F974}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FBB4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FF92}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FF92}\FriendlyName = "vMix Video YV12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FAA4}\FriendlyName = "vMix Video External 3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FCC4}\CLSID = "{8E14549A-DB61-4309-AFA1-3578E927FCC4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FCC4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927FBB4}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{8E14549A-DB61-4309-AFA1-3578E927FDD4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E14549A-DB61-4309-AFA1-3578E927E938}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4308	2008	regsvr32.exe	73
PID 2008 wrote to memory of 4308	2008	regsvr32.exe	73
PID 2008 wrote to memory of 4308	2008	regsvr32.exe	73

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d58de6f06e9f24f061f1c5f1225286089b029dc8e15e39ebdcef542c1c8e1bd2.dll
  2⤵
  - Modifies registry class
  PID:4308

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads