6452cc9f1d65526383f861bbe380dee0a65c7f00c66a9033d8e6750e1b677275 | Triage

Analysis

max time kernel
147s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 23:14

Sharing

Report Analysis Logs

General

Target

c717cdbd54422e18ce2fdd4e31f4a7d0.dll
Size

88KB
MD5

c717cdbd54422e18ce2fdd4e31f4a7d0
SHA1

2985dbce9d6d4ee4e6e3296220ea25e0ce4651d9
SHA256

6452cc9f1d65526383f861bbe380dee0a65c7f00c66a9033d8e6750e1b677275
SHA512

ad4645481ee72b56f68688351a71a59b9e4d40ca0b50036ed95bed94a624df87e982a83f78c64b88fee9cb916fc95f327753607501068b1445e6b85400d8a4ad
SSDEEP

1536:vbf0E0gYqRN9w+YkXjTksVRfMplcoss3Gf:r0GRN9wcs2Mjcoss3Gf

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c717cdbd54422e18ce2fdd4e31f4a7d0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4344	5040	regsvr32.exe	97
PID 5040 wrote to memory of 4344	5040	regsvr32.exe	97
PID 5040 wrote to memory of 4344	5040	regsvr32.exe	97

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c717cdbd54422e18ce2fdd4e31f4a7d0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c717cdbd54422e18ce2fdd4e31f4a7d0.dll
  2⤵
  - Modifies registry class
  PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads