c9454374c11b635021bda5942bfa9e7e26c8f4d915da26261e2eeab597f5b71f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PortableDeviceTypes.dll
Size

151KB
MD5

53db7fd818f37ca33ed42b8876db69b8
SHA1

22014c7390457cad2495372aad5e84da6bb4a155
SHA256

c9454374c11b635021bda5942bfa9e7e26c8f4d915da26261e2eeab597f5b71f
SHA512

77e9b62b0e7c78ae2d7957c8802b745a1f0704d269dca1fafa6eb5f7c98481031103a1478dfeff7cce5ba1e8397a952cf27dc6f0bdf8a75d9544995addf9edfd
SSDEEP

3072:9BWCDAQgz81NX8Kw4a8QQMsDqjSye4uV46N5ya35:uqRRDqGhNpN9

Score

1^/10

Malware Config

Signatures

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6848F6F2-3155-4F86-B6F5-263EEEAB3143}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6848F6F2-3155-4F86-B6F5-263EEEAB3143}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DADA2357-E0AD-492E-98DB-DD61C53BA353}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89B2E422-4F1B-4316-BCEF-A44AFEA83EB3}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6848F6F2-3155-4F86-B6F5-263EEEAB3143}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32F4002-BB27-45FF-AF4F-06631C1E8DAD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E3F2D79-4E07-48C4-8208-D8C2E5AF4A99}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B32F4002-BB27-45FF-AF4F-06631C1E8DAD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32F4002-BB27-45FF-AF4F-06631C1E8DAD}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89B2E422-4F1B-4316-BCEF-A44AFEA83EB3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DADA2357-E0AD-492E-98DB-DD61C53BA353}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E3F2D79-4E07-48C4-8208-D8C2E5AF4A99}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32F4002-BB27-45FF-AF4F-06631C1E8DAD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B32F4002-BB27-45FF-AF4F-06631C1E8DAD}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B00BA2F-E750-4BEB-9235-97142EDE1D3E}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B00BA2F-E750-4BEB-9235-97142EDE1D3E}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DADA2357-E0AD-492E-98DB-DD61C53BA353}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89B2E422-4F1B-4316-BCEF-A44AFEA83EB3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E3F2D79-4E07-48C4-8208-D8C2E5AF4A99}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B00BA2F-E750-4BEB-9235-97142EDE1D3E}\1.0	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3696	4364	regsvr32.exe	84
PID 4364 wrote to memory of 3696	4364	regsvr32.exe	84
PID 4364 wrote to memory of 3696	4364	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PortableDeviceTypes.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\PortableDeviceTypes.dll
  2⤵
  - Modifies registry class
  PID:3696

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads