412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:22

Target

412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9.dll
Size

3.4MB
MD5

0ce7c03e7ef8a60a4d9493dd627125e5
SHA1

873da1ff3ab630d51438c7a7eba0f12f4dda1e38
SHA256

412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9
SHA512

2a898a8298d924a3ef966d973bb552b16025d5ae7f19405ea510896d23940aa5d8ee514005ab2f86f6c51f23d438b6076cd279390e2c24aed25072da5ee818e6
SSDEEP

98304:2rzi/nEi2PO5uVA1wzUVzH01C6roRvN6:2Hi/nEi2PNB2c

Score

1^/10

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\ = "万能五笔输入法"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

820 regsvr32.exe

Suspicious use of FindShellTrayWindow 20 IoCs

Processes:

regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1812 wrote to memory of 820	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 820	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 820	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 820	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 820	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 820	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 820	1812	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1812