c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 00:18

Target

c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll
Size

1.1MB
MD5

31b091da1ab49814d07575b562940a75
SHA1

5ff2142c3e830e777d633bea70d6716ccef071cc
SHA256

c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa
SHA512

59812bdd47e67e9c5fd14d49de5a5503cf2abdc9f2d0db80ad265875612d7806e3c9826ba556fa94a9c7109e893aa0f4c69244316009e3b051a070a26134a2f5
SSDEEP

24576:92LOpzLN0qbGUs44T6I9l7VhcVCXfTFDNPo5R4hMmx:kO0qD4TZLXfThGvmx

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{B9527CB5-D9C2-44F3-B6A7-AFFC99E32884}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{B9527CB5-D9C2-44F3-B6A7-AFFC99E32884}\DllSurrogate	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\AppID = "{B9527CB5-D9C2-44F3-B6A7-AFFC99E32884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{B9527CB5-D9C2-44F3-B6A7-AFFC99E32884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1384	2636	regsvr32.exe	89
PID 2636 wrote to memory of 1384	2636	regsvr32.exe	89
PID 2636 wrote to memory of 1384	2636	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c1129491ce7fda59d7ec10aa9b88e7d21afcc2419881673e2db40bddfd1545aa.dll
  2⤵
  - Modifies registry class
  PID:1384