585a9cbdd27f5a8dcd755605832f292d525024e2daa401887cb9c78975eb4f2b | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 05:53

Sharing

Report Analysis Logs

General

Target

comuid.dll
Size

571KB
MD5

40e947f18137a41d36858cdab4bfc1b3
SHA1

c7fbbdb448876174d28df35d8099241567edb221
SHA256

585a9cbdd27f5a8dcd755605832f292d525024e2daa401887cb9c78975eb4f2b
SHA512

8a716fe1da96103a49d4879dce6b17864a2dc6bd562f554698c86e77a541f6d28cdedb6b1c7d008802bd4f316a31a3408cb3f57fdc3cac50c6a645ebf9487dfa
SSDEEP

12288:dgDIsVpVP8L472n2ppjCjnicOGl6osrMs51Kn2nAMO:dlCVP+4722ppgicOTNMs51K2nAb

Score

1^/10

Malware Config

Signatures

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{016FD94E-B02A-4AB8-94C6-149FDAB56B8D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{016FD94E-B02A-4AB8-94C6-149FDAB56B8D}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{016FD94E-B02A-4AB8-94C6-149FDAB56B8D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{016FD94E-B02A-4AB8-94C6-149FDAB56B8D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{016FD94E-B02A-4AB8-94C6-149FDAB56B8D}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2360	1972	regsvr32.exe	28
PID 1972 wrote to memory of 2360	1972	regsvr32.exe	28
PID 1972 wrote to memory of 2360	1972	regsvr32.exe	28
PID 1972 wrote to memory of 2360	1972	regsvr32.exe	28
PID 1972 wrote to memory of 2360	1972	regsvr32.exe	28
PID 1972 wrote to memory of 2360	1972	regsvr32.exe	28
PID 1972 wrote to memory of 2360	1972	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\comuid.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\comuid.dll
  2⤵
  - Modifies registry class
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads