1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll
Size

361KB
MD5

2e20e7577720dfc63bf519442c505199
SHA1

c7e544195f1583892b76089f87b648cf1816470d
SHA256

1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c
SHA512

25986b9739e61811716a86ae33ff2c69c52912a164c2a561171ac8fc2ad5baea7cf0727396673c4c960df32df2cfe3fdb6e78b70dfed2cedcceba72b47f6da56
SSDEEP

3072:1Zr97TeKgCi8RhgAWIY3Lab00WLZr97TeKgCjjn:X5TxL99+x5TxLX

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\ = "Maihook1007"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\ProgID\ = "1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007\Clsid\ = "{78E611A2-E484-4A0D-811E-C40100A3F452}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007\ = "Maihook1007"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1936	4848	regsvr32.exe	82
PID 4848 wrote to memory of 1936	4848	regsvr32.exe	82
PID 4848 wrote to memory of 1936	4848	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll
  2⤵
  - Modifies registry class
  PID:1936

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads