9e74ee1c7d94e91e0da099051323da9ee2d7e242ff4f7a96ae994dc4f35fdc31

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e74ee1c7d94e91e0da099051323da9ee2d7e242ff4f7a96ae994dc4f35fdc31.dll
Size

296KB
MD5

0a1f56261d0c53cda9f6c6452dccf5c6
SHA1

7ec516d1ba123c6849d7ed6bdd690d46e4b2cbea
SHA256

9e74ee1c7d94e91e0da099051323da9ee2d7e242ff4f7a96ae994dc4f35fdc31
SHA512

82ee7b4b88d39bb3926c4dc2bbba8e9107f0923622300aa0465a39e7578a4d4cba1911d248fe54cf7b64ba48a0a147bb6d3b38d70480e2a6a6c450956983be52
SSDEEP

3072:utQRi4ozOegqs0uwp8abY7Of+hXr4kb4ddMJ6JF9Jh8lOzTnWpUDn6:uzQUGEYqGh74kbiyW9vlzf

Score

1^/10

Malware Config

Signatures

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ = "IAccessible"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\ = "{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\NumMethods\ = "28"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\ = "{03022430-ABC4-11D0-BDE2-00AA001A1953}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3056	3004	regsvr32.exe	28
PID 3004 wrote to memory of 3056	3004	regsvr32.exe	28
PID 3004 wrote to memory of 3056	3004	regsvr32.exe	28
PID 3004 wrote to memory of 3056	3004	regsvr32.exe	28
PID 3004 wrote to memory of 3056	3004	regsvr32.exe	28
PID 3004 wrote to memory of 3056	3004	regsvr32.exe	28
PID 3004 wrote to memory of 3056	3004	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e74ee1c7d94e91e0da099051323da9ee2d7e242ff4f7a96ae994dc4f35fdc31.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e74ee1c7d94e91e0da099051323da9ee2d7e242ff4f7a96ae994dc4f35fdc31.dll
  2⤵
  - Modifies registry class
  PID:3056

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads