27e111fa955f2ad006caffc5ffc23f195b44226e7437830d46db6c0bda599392

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 23:42

Target

aa7342fab439e24f1b7921b2579b72a1.dll
Size

22KB
MD5

aa7342fab439e24f1b7921b2579b72a1
SHA1

d487b0d2e05492efa9ac0da4dcf5ec58ff7235bb
SHA256

27e111fa955f2ad006caffc5ffc23f195b44226e7437830d46db6c0bda599392
SHA512

ea4b21b849126919a0512e99d2010e9552561985ae4ef1d53f1c67d6314f03ef2703771bed16f77cfcefb4c4de72f7c2af97d1f03b4d263bd4b6944ed98cbb89
SSDEEP

384:tQS6PHzKfB0aOXjCq+gxSTzs7krLgUeFPagS5zlfZmA:tQlTwB02qnQHgvFPagSHhF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/116-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\ = "pl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aa7342fab439e24f1b7921b2579b72a1.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\ProgID\ = "Ms. plugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\TypeLib\ = "{02A4DEB7-1FC1-4ca4-A3FA-48B31A7756ED}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DC8CA1D-D31A-474b-979A-A3823FA34ED8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 116	1268	regsvr32.exe	87
PID 1268 wrote to memory of 116	1268	regsvr32.exe	87
PID 1268 wrote to memory of 116	1268	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa7342fab439e24f1b7921b2579b72a1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aa7342fab439e24f1b7921b2579b72a1.dll
  2⤵
  - Modifies registry class
  PID:116

memory/116-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download