27e111fa955f2ad006caffc5ffc23f195b44226e7437830d46db6c0bda599392

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 23:42

Target

aa7342fab439e24f1b7921b2579b72a1.dll
Size

22KB
MD5

aa7342fab439e24f1b7921b2579b72a1
SHA1

d487b0d2e05492efa9ac0da4dcf5ec58ff7235bb
SHA256

27e111fa955f2ad006caffc5ffc23f195b44226e7437830d46db6c0bda599392
SHA512

ea4b21b849126919a0512e99d2010e9552561985ae4ef1d53f1c67d6314f03ef2703771bed16f77cfcefb4c4de72f7c2af97d1f03b4d263bd4b6944ed98cbb89
SSDEEP

384:tQS6PHzKfB0aOXjCq+gxSTzs7krLgUeFPagS5zlfZmA:tQlTwB02qnQHgvFPagSHhF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2156-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\ = "pl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aa7342fab439e24f1b7921b2579b72a1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\TypeLib\ = "{02A4DEB7-1FC1-4ca4-A3FA-48B31A7756ED}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\ProgID\ = "Ms. plugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2156	1844	regsvr32.exe	28
PID 1844 wrote to memory of 2156	1844	regsvr32.exe	28
PID 1844 wrote to memory of 2156	1844	regsvr32.exe	28
PID 1844 wrote to memory of 2156	1844	regsvr32.exe	28
PID 1844 wrote to memory of 2156	1844	regsvr32.exe	28
PID 1844 wrote to memory of 2156	1844	regsvr32.exe	28
PID 1844 wrote to memory of 2156	1844	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa7342fab439e24f1b7921b2579b72a1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aa7342fab439e24f1b7921b2579b72a1.dll
  2⤵
  - Modifies registry class
  PID:2156

memory/2156-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download