1d14500a00d5f63a796ae8002eaacb21ee3feb348ab52f3d74c85c0f914347c5

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 00:24

Target

bin/MFC42.dll
Size

972KB
MD5

28f2911af34f73259a9c5dffcbf71a00
SHA1

ab00aa78540eced023d8a8484cdcdb7132c4fbed
SHA256

aa8c615c8bbcd8ad4a9b624addb512e0702223eb5f266ce8f6a9a005f718a483
SHA512

f58b47e485411c21d96afda97cc08d51ebb3c05e060411f6be98db309a485d71e35de7ffd5a413800934dfac3b8101b123b7e1d35c0c1108caea9b36eb8d7d11
SSDEEP

12288:ZDuuMGWwg2zR5wrbY8pH21TQYfuSuyKixQTUUAex9mSCQiF7Jm7VynzY09hctGa:8uP3cbY8tGvF3KiDU3PvZHUn6n

Score

1^/10

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1756	1200	regsvr32.exe	28
PID 1200 wrote to memory of 1756	1200	regsvr32.exe	28
PID 1200 wrote to memory of 1756	1200	regsvr32.exe	28
PID 1200 wrote to memory of 1756	1200	regsvr32.exe	28
PID 1200 wrote to memory of 1756	1200	regsvr32.exe	28
PID 1200 wrote to memory of 1756	1200	regsvr32.exe	28
PID 1200 wrote to memory of 1756	1200	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bin\MFC42.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bin\MFC42.dll
  2⤵
  - Modifies registry class
  PID:1756