91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll
Size

804KB
MD5

731f07dbd6afcfc42d51302aa0428fee
SHA1

eee16c589f159fa0ce107fc9ac4b5cdd7b754de8
SHA256

91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9
SHA512

18bfc1d3985cf6e3621fb5402d752f7d469099699b05324324d6aac0fa2b60ef94815b5a295de49cc109651c643b938914dc713c608fdbf38686edf8e352137c
SSDEEP

3072:/rw0XWPrCMplVhFdhRdkP4Ms6odq7r5DSCFS9d5yzVsJrw2Rn:/UBPB3FDPkP4MX4yr5DSWSGVsJE+

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\Version = "6d.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\TypeLib\ = "{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\VERSION\ = "109.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\ = "eCrash Database Update Component"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ = "Scripts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\ProgID\ = "eCrash_DBUpd.Scripts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts\ = "eCrash_DBUpd.Scripts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\ = "{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ = "_Scripts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts\Clsid\ = "{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ = "_Scripts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\ = "{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\ = "eCrash_DBUpd.Scripts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\Version = "6d.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 3468	3820	regsvr32.exe	89
PID 3820 wrote to memory of 3468	3820	regsvr32.exe	89
PID 3820 wrote to memory of 3468	3820	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll
  2⤵
  - Modifies registry class
  PID:3468

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads