4a28a38bcc29afd74765e75076da4f3b61df4645369819370047455d33c68a4c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 14:25

Target

cba43e3d3d69f1e2b02434e21e5d1efd.dll
Size

96KB
MD5

cba43e3d3d69f1e2b02434e21e5d1efd
SHA1

c811de2c5d098f6bdf2018f944c162dffde863ef
SHA256

4a28a38bcc29afd74765e75076da4f3b61df4645369819370047455d33c68a4c
SHA512

9e1b28fef9cd6ef875fcfdfc7f2ec69b3468e53795b07f865a65faa47ed49a83e722c317bfb799e5cd4d7ff789be39eeeae98972b4e9def65b52305669a18768
SSDEEP

1536:/+0+3DUiIOGnYHq2mwggFd0dev2aLyZ/cosv5SNP1rp8HDSzy:GXUiuYggt2H/cosv5SNPJ+HDSzy

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cba43e3d3d69f1e2b02434e21e5d1efd.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{23539089-449C-270A-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 2400	3752	regsvr32.exe	89
PID 3752 wrote to memory of 2400	3752	regsvr32.exe	89
PID 3752 wrote to memory of 2400	3752	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cba43e3d3d69f1e2b02434e21e5d1efd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cba43e3d3d69f1e2b02434e21e5d1efd.dll
  2⤵
  - Modifies registry class
  PID:2400