d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 00:04

Target

d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll
Size

1.1MB
MD5

6d84601d04c168808c34308548c6100a
SHA1

0af153c2ff1a3f151f5b06a346aac0c7a755a38f
SHA256

d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc
SHA512

b359c77142c9f0881d1eec5b37281f370cae938b90cfdeed42b5b178121de68b08b103f4df7eafb9c89920581ef95823973196921bcc5e53e27390bc0a6ee230
SSDEEP

24576:92LOpzLN0qbGUs44T6I9l7VhcVCXfTFDNPo5R4hMmZ:kO0qD4TZLXfThGvmZ

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EDEE6011-F91D-4540-889F-27064605EB17}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EDEE6011-F91D-4540-889F-27064605EB17}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EDEE6011-F91D-4540-889F-27064605EB17}\DllSurrogate	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\AppID = "{EDEE6011-F91D-4540-889F-27064605EB17}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 776	4396	regsvr32.exe	88
PID 4396 wrote to memory of 776	4396	regsvr32.exe	88
PID 4396 wrote to memory of 776	4396	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d6615f762c248532fed50b77d8cafa983069571bf4c5ed12790728b8955b03cc.dll
  2⤵
  - Modifies registry class
  PID:776