0f95960120449aeba54a96103c366bfa8d922bc2fe72cbe0ff3565ec3ae03d42

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 12:16

Target

$PLUGINSDIR/OCSetupHlp.dll
Size

763KB
MD5

7c6b0d9fe494f9ce92b12d1877cc7efe
SHA1

4f82a3193c133743f71c4bf02de39cd79aeb64c8
SHA256

1e9e818060df428c457b4d04962bc1cbdc942e8c17d55d453ab2e9f47b59b8f4
SHA512

a8e410a39ba6f75e69e68662c81a040f215dfed976f6c0b6da070078d863df57fbd6aa8af9a7424fd3330d0980af308fd389438409cfb44f80a2fc013dcf209b
SSDEEP

12288:LEf6X+0AsJFFq1TdYg1g2swfkhxyiRfTrKTpolJnK3WK:QA3JFFeTdYg1g2sxyiRfqTpoHK3WK

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OCSetupHlp.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\ = "OCVBValidateLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1116	1728	regsvr32.exe	28
PID 1728 wrote to memory of 1116	1728	regsvr32.exe	28
PID 1728 wrote to memory of 1116	1728	regsvr32.exe	28
PID 1728 wrote to memory of 1116	1728	regsvr32.exe	28
PID 1728 wrote to memory of 1116	1728	regsvr32.exe	28
PID 1728 wrote to memory of 1116	1728	regsvr32.exe	28
PID 1728 wrote to memory of 1116	1728	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OCSetupHlp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OCSetupHlp.dll
  2⤵
  - Modifies registry class
  PID:1116