4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 05:47

Target

$PROGRAM_FILES_COMMON/Borland Shared/BDE/idapi32.dll
Size

575KB
MD5

4de81f3fd32b82b6bd813203205dd7c8
SHA1

f725e57294276bc03ba7c0b37d767b11ea87730e
SHA256

fc2faec98fd7167cf7d25fa773ec8ecead0dfc678ca1ffaf6b34f78bac91a91e
SHA512

73daa12e0533161e39abc2f3a33befd87b2ffaaa909c7801571b4944ba0f3e2bc27d324f0c27dfb963289cb66127d3e763e323a5ea292ed88e81f5ad2ac9f28e
SSDEEP

12288:zDBke8E5cre8ZacFRrVUl5eXH+1lIH3Yzpewk:zVke89e8jbWLeXH+1luspE

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB99D710-18B9-11D0-A4CF-00A024C91936}\ = "Borland Database Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB99D710-18B9-11D0-A4CF-00A024C91936}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Database_Engine.4\ = "Borland Database Engine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Database_Engine.4\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB99D710-18B9-11D0-A4CF-00A024C91936}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB99D710-18B9-11D0-A4CF-00A024C91936}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB99D710-18B9-11D0-A4CF-00A024C91936}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PROGRAM_FILES_COMMON\\Borland Shared\\BDE\\idapi32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Database_Engine.4	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Database_Engine.4\Clsid\ = "{FB99D710-18B9-11D0-A4CF-00A024C91936}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1860	3736	regsvr32.exe	84
PID 3736 wrote to memory of 1860	3736	regsvr32.exe	84
PID 3736 wrote to memory of 1860	3736	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\idapi32.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\idapi32.dll"
  2⤵
  - Modifies registry class
  PID:1860

memory/1860-0-0x000000004BDE0000-0x000000004BE7A000-memory.dmp

Filesize
616KB

Download