d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 00:04

Target

d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll
Size

1.1MB
MD5

6d84601d04c168808c34308548c6100a
SHA1

0af153c2ff1a3f151f5b06a346aac0c7a755a38f
SHA256

d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc
SHA512

b359c77142c9f0881d1eec5b37281f370cae938b90cfdeed42b5b178121de68b08b103f4df7eafb9c89920581ef95823973196921bcc5e53e27390bc0a6ee230
SSDEEP

24576:92LOpzLN0qbGUs44T6I9l7VhcVCXfTFDNPo5R4hMmZ:kO0qD4TZLXfThGvmZ

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C3EBF107-02A4-40B5-A3D0-43F42FFECF2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C3EBF107-02A4-40B5-A3D0-43F42FFECF2F}\DllSurrogate	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\AppID = "{C3EBF107-02A4-40B5-A3D0-43F42FFECF2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C3EBF107-02A4-40B5-A3D0-43F42FFECF2F}\	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2840	1716	regsvr32.exe	28
PID 1716 wrote to memory of 2840	1716	regsvr32.exe	28
PID 1716 wrote to memory of 2840	1716	regsvr32.exe	28
PID 1716 wrote to memory of 2840	1716	regsvr32.exe	28
PID 1716 wrote to memory of 2840	1716	regsvr32.exe	28
PID 1716 wrote to memory of 2840	1716	regsvr32.exe	28
PID 1716 wrote to memory of 2840	1716	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll
  2⤵
  - Modifies registry class
  PID:2840