6452cc9f1d65526383f861bbe380dee0a65c7f00c66a9033d8e6750e1b677275 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 23:14

Sharing

Report Analysis Logs

General

Target

c717cdbd54422e18ce2fdd4e31f4a7d0.dll
Size

88KB
MD5

c717cdbd54422e18ce2fdd4e31f4a7d0
SHA1

2985dbce9d6d4ee4e6e3296220ea25e0ce4651d9
SHA256

6452cc9f1d65526383f861bbe380dee0a65c7f00c66a9033d8e6750e1b677275
SHA512

ad4645481ee72b56f68688351a71a59b9e4d40ca0b50036ed95bed94a624df87e982a83f78c64b88fee9cb916fc95f327753607501068b1445e6b85400d8a4ad
SSDEEP

1536:vbf0E0gYqRN9w+YkXjTksVRfMplcoss3Gf:r0GRN9wcs2Mjcoss3Gf

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c717cdbd54422e18ce2fdd4e31f4a7d0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2136	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2136	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2136	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2136	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2136	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2136	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2136	3012	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c717cdbd54422e18ce2fdd4e31f4a7d0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c717cdbd54422e18ce2fdd4e31f4a7d0.dll
  2⤵
  - Modifies registry class
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads