da2e721f400bcba70540dcd4384019c0075cbb74c87c50b86ff5b5c7dff2e756

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da2e721f400bcba70540dcd4384019c0075cbb74c87c50b86ff5b5c7dff2e756.dll
Size

366KB
MD5

524effd65fe067404a1654b220717555
SHA1

80eb8263a101aafa5685ba1188cba92cf46f6028
SHA256

da2e721f400bcba70540dcd4384019c0075cbb74c87c50b86ff5b5c7dff2e756
SHA512

8c9fdc5b52efe63b594e6f7cd81298214bad23a69272542b0c18259690beff063eed851788843cae2cf784f6a0aa90d2e5b377ee37abc7581fe170773216434d
SSDEEP

3072:JbPvTpVpA4NpX/wZW4w9bqbN/76J0KW1mEqMDQ+3kFKGuxL0pG587C1vD:BvTpVpNNpX/6W4w9bS/5XmEqu0FKGWxL

Score

1^/10

Malware Config

Signatures

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020021-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020001-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000F-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020021-0000-0000-C000-000000000046}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020020-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020000-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020003-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000D-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000F-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002000D-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020020-0000-0000-C000-000000000046}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020000-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020001-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020003-0000-0000-C000-000000000046}\InprocServer	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2552	2240	regsvr32.exe	28
PID 2240 wrote to memory of 2552	2240	regsvr32.exe	28
PID 2240 wrote to memory of 2552	2240	regsvr32.exe	28
PID 2240 wrote to memory of 2552	2240	regsvr32.exe	28
PID 2240 wrote to memory of 2552	2240	regsvr32.exe	28
PID 2240 wrote to memory of 2552	2240	regsvr32.exe	28
PID 2240 wrote to memory of 2552	2240	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da2e721f400bcba70540dcd4384019c0075cbb74c87c50b86ff5b5c7dff2e756.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\da2e721f400bcba70540dcd4384019c0075cbb74c87c50b86ff5b5c7dff2e756.dll
  2⤵
  - Modifies registry class
  PID:2552

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads