1234fca475092501d14959a1150d53c1817759cfb3960376640065467590cd66

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 07:38

Target

$PLUGINSDIR/OCSetupHlp.dll
Size

842KB
MD5

5b8d0d2cd9d60412262f166e15357961
SHA1

cab78c31f513d1f2bf43205af88a3bbfab11b1ca
SHA256

2c028b33da28063270a7c4f7f8affafdea63a766627178cb166253f14f3a4c4e
SHA512

e4a05b5479c1b9edc49d36356e1a7e212cc100f11d600bae8d6303a6c1e1ed329c10eaa1d5228860d3a7999147bc8c920c07f3acaf197f1b8df955a583c7230f
SSDEEP

12288:b+wnK6z+X9XgFnDgQlOpmtZkYZYiWRREaQDEK/8MoSTLyrQCT30:iTdwZDgQ4p2ZkCYHtQIK/8M7TLyrQe0

Score

1^/10

Modifies registry class 10 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\ = "OCVBValidateLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OCSetupHlp.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2856 wrote to memory of 2076	2856	regsvr32.exe	regsvr32.exe
PID 2856 wrote to memory of 2076	2856	regsvr32.exe	regsvr32.exe
PID 2856 wrote to memory of 2076	2856	regsvr32.exe	regsvr32.exe
PID 2856 wrote to memory of 2076	2856	regsvr32.exe	regsvr32.exe
PID 2856 wrote to memory of 2076	2856	regsvr32.exe	regsvr32.exe
PID 2856 wrote to memory of 2076	2856	regsvr32.exe	regsvr32.exe
PID 2856 wrote to memory of 2076	2856	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OCSetupHlp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OCSetupHlp.dll
2⤵
- Modifies registry class
PID:2076