c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/deployJava1.dll
Size 401KB
Sample240603-pypr7sgc32
SHA256 e4fb1438b24c73de0b455265f80a775bd441fc17a0d9d66104b891e4aa4398fb
MD5 b8f7c6ca5f8e97249853dbe1dadd1fbc
SHA1 c29d893d775cca32fa5cd65806867ad963ab356c
SHA512 8f56305f7240dcc2f9f73f2edbe67c76dbde3a159cd39f02fbf2a83d118511225afdfe3dfc35701d972984331b4301eab9b467cf791884a1ab6251ee3798e089
SSDEEP 6144:zSWaXhK8kiR+iQbejtMm+jYQK6+vU9hT7yy8R0cSjvBD:tA3L+iDjtMmxvU9hT7yy8R0njZD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}\Deployment Toolkit = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}\InprocServer32	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}\InprocServer32\C:\Users\Admin\AppData\Local\Temp\lib\bin\deployJava1.dll = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}\InprocServer32\Apartment = "268607724"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2604	2320	regsvr32.exe	28
PID 2320 wrote to memory of 2604	2320	regsvr32.exe	28
PID 2320 wrote to memory of 2604	2320	regsvr32.exe	28
PID 2320 wrote to memory of 2604	2320	regsvr32.exe	28
PID 2320 wrote to memory of 2604	2320	regsvr32.exe	28
PID 2320 wrote to memory of 2604	2320	regsvr32.exe	28
PID 2320 wrote to memory of 2604	2320	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lib\bin\deployJava1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\lib\bin\deployJava1.dll
  2⤵
  - Modifies registry class
  PID:2604