412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 01:22

Target

412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9.dll
Size

3.4MB
MD5

0ce7c03e7ef8a60a4d9493dd627125e5
SHA1

873da1ff3ab630d51438c7a7eba0f12f4dda1e38
SHA256

412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9
SHA512

2a898a8298d924a3ef966d973bb552b16025d5ae7f19405ea510896d23940aa5d8ee514005ab2f86f6c51f23d438b6076cd279390e2c24aed25072da5ee818e6
SSDEEP

98304:2rzi/nEi2PO5uVA1wzUVzH01C6roRvN6:2Hi/nEi2PNB2c

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\ = "万能五笔输入法"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F233D5B-E44C-47DE-B1CC-2C92FEDE6CE1}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9.dll"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	regsvr32.exe
1220	regsvr32.exe

Suspicious use of FindShellTrayWindow 20 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 1220	3516	regsvr32.exe	82
PID 3516 wrote to memory of 1220	3516	regsvr32.exe	82
PID 3516 wrote to memory of 1220	3516	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\412874adcd4433e43ef1b17328fe5d5b1ac340a4fe6e8203b069390d6e00a9d9.dll
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1220