d618b457c1310790385c4efeb88e8afaa61876e42b17bc329bb148694a4b5a00

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/test/formsend/vcbuild.dll
Size

11KB
MD5

1b84d7e16763d4686874c20e07437bec
SHA1

9d3088e977c5b6a322bdeb538487a73887fbcc0e
SHA256

a020d37724b738aab3c295917b6a23f8de45449177615a88e7c93627de424280
SHA512

4f9715ed1d8473c884965688dc9e4c06d53143240909c096ef340ed3e4ddf157331b0417fcb334a5c8b2b7c25b609f21262d8f3863567e3cbb4e05a3396f4821
SSDEEP

192:IIeYBmMNCZ2LjRj23/pv6u5TN3XSGMKS6vrkrbAVuWDxpBSWNLft5AgI/:LNBma2GjR23/IuToKS68nWD0WlftpW

Score

1^/10

Malware Config

Signatures

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ProxyStubClsid32\ = "{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\ProxyStubClsid32\ = "{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\ = "IENCBuildSpawnerCallback"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\ProxyStubClsid32\ = "{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\NumMethods\ = "27"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ = "IVCBuildErrorContext"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\NumMethods\ = "6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\ = "IENCBuildSpawner"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$APPDATA\\test\\formsend\\vcbuild.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1468	2824	regsvr32.exe	28
PID 2824 wrote to memory of 1468	2824	regsvr32.exe	28
PID 2824 wrote to memory of 1468	2824	regsvr32.exe	28
PID 2824 wrote to memory of 1468	2824	regsvr32.exe	28
PID 2824 wrote to memory of 1468	2824	regsvr32.exe	28
PID 2824 wrote to memory of 1468	2824	regsvr32.exe	28
PID 2824 wrote to memory of 1468	2824	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\test\formsend\vcbuild.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\test\formsend\vcbuild.dll
  2⤵
  - Modifies registry class
  PID:1468

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads