1f7ef8b1a6086856510af6ee1323aeff590538ef74d32de931dd2db39f0ea5cd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

DTKVideoCap.dll
Size

2.6MB
MD5

591c020aabe0517e8415efc5e1a0c8e1
SHA1

a6fa0edda651eef49fa1e91a8ef691fdadfc2037
SHA256

1f7ef8b1a6086856510af6ee1323aeff590538ef74d32de931dd2db39f0ea5cd
SHA512

49096f8d364e4a510455be896482f6a37cb5cc9ee63c8b0ecc8c5c45e51f1488fdd8928e2722abc865295ae909971cc67174def2ddbb708c6b32e8d64e5096cf
SSDEEP

49152:GDeV/RNIOL7a2A5XNt/EhVuCHqzNHoTpoJoB:GDCTIO3a15dt/EhVuCgPJ0

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DTKVideoCap.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.DTKVideoCapture.1\ = "DTK Video Capture Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8945832-23D7-4190-B7F5-CE244102C5C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.VideoCaptureUtils\ = "VideoCaptureUtils Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4BEC944-C6FE-4CA4-BD12-16CE7078389A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8945832-23D7-4190-B7F5-CE244102C5C4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{984E9675-CAC7-4833-A4DF-44870277682C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}\1.0\ = "DTK Video Capture Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}\TypeLib\ = "{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{984E9675-CAC7-4833-A4DF-44870277682C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.VideoCaptureUtils.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.VideoCaptureUtils\CLSID\ = "{B20E277D-DC7F-4FC6-80C0-64D681F4E346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}\ProgID\ = "DTKVideoCap.DTKVideoCapture.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}\ = "_IDTKVideoCaptureEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8945832-23D7-4190-B7F5-CE244102C5C4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DTKVideoCap.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4BEC944-C6FE-4CA4-BD12-16CE7078389A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8945832-23D7-4190-B7F5-CE244102C5C4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\ = "VideoCaptureUtils Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.DTKVideoCapture\CLSID\ = "{4A85D6AC-F3A7-4892-807D-F453B0D153B1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4BEC944-C6FE-4CA4-BD12-16CE7078389A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}\ = "_IDTKVideoCaptureEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DTKVideoCap.DLL\AppID = "{8C65076F-160F-4B26-A514-29211F6EBC85}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.VideoCaptureUtils\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.DTKVideoCapture	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{984E9675-CAC7-4833-A4DF-44870277682C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.DTKVideoCapture.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8945832-23D7-4190-B7F5-CE244102C5C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8945832-23D7-4190-B7F5-CE244102C5C4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{984E9675-CAC7-4833-A4DF-44870277682C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\ProgID\ = "DTKVideoCap.VideoCaptureUtils.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.DTKVideoCapture.1\CLSID\ = "{4A85D6AC-F3A7-4892-807D-F453B0D153B1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.DTKVideoCapture\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4BEC944-C6FE-4CA4-BD12-16CE7078389A}\ = "IDTKVideoCapture"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4BEC944-C6FE-4CA4-BD12-16CE7078389A}\TypeLib\ = "{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.VideoCaptureUtils.1\ = "VideoCaptureUtils Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\VersionIndependentProgID\ = "DTKVideoCap.VideoCaptureUtils"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B1E8E973-3FDE-4EAF-BA5D-5FE036F0422C}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4BEC944-C6FE-4CA4-BD12-16CE7078389A}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{984E9675-CAC7-4833-A4DF-44870277682C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{984E9675-CAC7-4833-A4DF-44870277682C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B20E277D-DC7F-4FC6-80C0-64D681F4E346}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC826BE0-E835-41DA-BB82-F3ABBAADC5E6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4BEC944-C6FE-4CA4-BD12-16CE7078389A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}\VersionIndependentProgID\ = "DTKVideoCap.DTKVideoCapture"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A85D6AC-F3A7-4892-807D-F453B0D153B1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTKVideoCap.DTKVideoCapture\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 2428	3784	regsvr32.exe	83
PID 3784 wrote to memory of 2428	3784	regsvr32.exe	83
PID 3784 wrote to memory of 2428	3784	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DTKVideoCap.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DTKVideoCap.dll
  2⤵
  - Modifies registry class
  PID:2428

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads