d53e9ef04a4700df76586787dab9692b2ff599d09ceb09ee93128edfe7876f4c

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 05:43

Target
989ee5a9dfd78fc203161b3394e86f5c.dll
Size 812KB
Sample240213-ge3kyshh57
SHA256 d53e9ef04a4700df76586787dab9692b2ff599d09ceb09ee93128edfe7876f4c
MD5 989ee5a9dfd78fc203161b3394e86f5c
SHA1 d25fae3b8c319b4b0f32f4c4dd9a82de70360bcb
SHA512 2b943a388a40f10d7ef0b3112661131ed3b4ddc23fc8c086d833a6b1351adf729f01b886a86a1af4e1f6e3fa61fd48462bad0023ba5ee09cacbbe4db3eb008bf
SSDEEP 12288:+0FGvMiMEW5rSCAmrA5o0FGvMiMEW5rSCAmrA5I0FGvMiMEW5rSCAmrA5:XiM75rtAtiM75rtAFiM75rtA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\ = "XACT Engine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\989ee5a9dfd78fc203161b3394e86f5c.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2452	5076	regsvr32.exe	55
PID 5076 wrote to memory of 2452	5076	regsvr32.exe	55
PID 5076 wrote to memory of 2452	5076	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\989ee5a9dfd78fc203161b3394e86f5c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\989ee5a9dfd78fc203161b3394e86f5c.dll
  2⤵
  - Modifies registry class
  PID:2452