cdc3e2164a9c6cd5fbb2ef96582490b610c59dea22efc5f2f7e6800a09ecc448

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 02:29

Target

cdc3e2164a9c6cd5fbb2ef96582490b610c59dea22efc5f2f7e6800a09ecc448.dll
Size

401KB
MD5

82e4a628a626eef3f6ed502e875ad33e
SHA1

ad86565d4bd59763b92d0e824acdbdab32240d7d
SHA256

cdc3e2164a9c6cd5fbb2ef96582490b610c59dea22efc5f2f7e6800a09ecc448
SHA512

30d6bad5039de0b57a9b0ab52e746aae4d5deb5ae6cf133a2baa3e361fbe7f79b8e8a1430e2bc82eb8b9d6e5bbb6ac810020f7c8df9fc95322ac10d0e5d00ec4
SSDEEP

6144:0fsNhR7c3k7er0ggXqt8BJClDGZqdg0F0JANivsex6wAeX3dVH+ZV7GpEwH:tRc3zjeQsB0mJvkBu3dJqV7Gp

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cdc3e2164a9c6cd5fbb2ef96582490b610c59dea22efc5f2f7e6800a09ecc448.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB238754-3F4C-4FE9-B497-B7B950CB6436}\1.0\ = "CBSProvider 1.0 Type Library"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2356	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2356	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2356	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2356	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2356	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2356	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2356	2036	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cdc3e2164a9c6cd5fbb2ef96582490b610c59dea22efc5f2f7e6800a09ecc448.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cdc3e2164a9c6cd5fbb2ef96582490b610c59dea22efc5f2f7e6800a09ecc448.dll
  2⤵
  - Modifies registry class
  PID:2356

memory/2356-0-0x0000000074E80000-0x0000000074FE6000-memory.dmp

Filesize
1.4MB

Download