c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 00:18

Target

c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll
Size

1.1MB
MD5

31b091da1ab49814d07575b562940a75
SHA1

5ff2142c3e830e777d633bea70d6716ccef071cc
SHA256

c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa
SHA512

59812bdd47e67e9c5fd14d49de5a5503cf2abdc9f2d0db80ad265875612d7806e3c9826ba556fa94a9c7109e893aa0f4c69244316009e3b051a070a26134a2f5
SSDEEP

24576:92LOpzLN0qbGUs44T6I9l7VhcVCXfTFDNPo5R4hMmx:kO0qD4TZLXfThGvmx

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8FCDDBAD-5D03-48E4-A68E-909E86A1ACD6}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8FCDDBAD-5D03-48E4-A68E-909E86A1ACD6}\DllSurrogate	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\AppID = "{8FCDDBAD-5D03-48E4-A68E-909E86A1ACD6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8FCDDBAD-5D03-48E4-A68E-909E86A1ACD6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1932	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1932	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1932	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1932	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1932	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1932	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1932	1988	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll
  2⤵
  - Modifies registry class
  PID:1932