718407701cd364ffe71d52012a70794a138351a85d0d098abc6643ce89b579de

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 23:01

Target

718407701cd364ffe71d52012a70794a138351a85d0d098abc6643ce89b579de.dll
Size

1.1MB
MD5

80b1aa179e1da3b60be11f0ecbd5cfee
SHA1

86fcabf2a5a991d2b673c4d2c544b357b34834d1
SHA256

718407701cd364ffe71d52012a70794a138351a85d0d098abc6643ce89b579de
SHA512

2b738691277782bea0b2fd9a166ecf1725f621f2ea11ece0d15e24f1d15ec8d0b37c229f23b243c7449337fe7572a764e3630c2d9ede2556881cc88da32431a1
SSDEEP

24576:Tj8bZKikoOSmN6p/v2xtSiIOxSF+f6XIt2x/B+HWYqJ:sDk6mYRHMf6XL2qJ

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\AppID = "{0472811E-6617-466F-9E39-62FA064BECCC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\718407701cd364ffe71d52012a70794a138351a85d0d098abc6643ce89b579de.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0472811E-6617-466F-9E39-62FA064BECCC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0472811E-6617-466F-9E39-62FA064BECCC}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0472811E-6617-466F-9E39-62FA064BECCC}\DllSurrogate	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2752	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2752	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2752	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2752	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2752	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2752	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2752	2972	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\718407701cd364ffe71d52012a70794a138351a85d0d098abc6643ce89b579de.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\718407701cd364ffe71d52012a70794a138351a85d0d098abc6643ce89b579de.dll
  2⤵
  - Modifies registry class
  PID:2752