0706c050df0321cb0ab84b083c41e6f7cca23bb008eebd7d7635b73a2e4c249c | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 00:32

Sharing

Report Analysis Logs

General

Target

98051e47ae60911dfc64408475f9e7a3.dll
Size

92KB
MD5

98051e47ae60911dfc64408475f9e7a3
SHA1

c117355786dc0e81aa91526a33aff8885bbeaf91
SHA256

0706c050df0321cb0ab84b083c41e6f7cca23bb008eebd7d7635b73a2e4c249c
SHA512

6c1577dd34d773b88300e0e98cfb6db3dce7921fd6ac663603983a306f48393111720f6125138e19928c9b0693aa27074bb1fff250e8212f104965d7c06904f5
SSDEEP

1536:oHTkUFGb+BxL9okX2clwGIIf+UC0CcosoCi9FEJ7:epGb6ZRJ+3cosoCi9Fs

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\98051e47ae60911dfc64408475f9e7a3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2760	308	regsvr32.exe	28
PID 308 wrote to memory of 2760	308	regsvr32.exe	28
PID 308 wrote to memory of 2760	308	regsvr32.exe	28
PID 308 wrote to memory of 2760	308	regsvr32.exe	28
PID 308 wrote to memory of 2760	308	regsvr32.exe	28
PID 308 wrote to memory of 2760	308	regsvr32.exe	28
PID 308 wrote to memory of 2760	308	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\98051e47ae60911dfc64408475f9e7a3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\98051e47ae60911dfc64408475f9e7a3.dll
  2⤵
  - Modifies registry class
  PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads