89808b6926dd83e93b3db9c28a90b55f5b2b4312b666138e469ea55cfb7614ff

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 13:29

Target

89808b6926dd83e93b3db9c28a90b55f5b2b4312b666138e469ea55cfb7614ff.dll
Size

288KB
MD5

30873d9daf6f5826c98fc637873bdb20
SHA1

81ecf1aee071c2f9aaf0b5219c3d83acd80885df
SHA256

89808b6926dd83e93b3db9c28a90b55f5b2b4312b666138e469ea55cfb7614ff
SHA512

dbf894f6c85a0c713a4167738f427d00b04f96586ff539988dcd5712061d61bfb98d1ff00783f45f4604cd7f429a1007b382ff790d2af1d10fbcacbe3588ccdf
SSDEEP

3072:iO32YCddygAGM4NHY1CFqdcsAghXE0eMW+VRxazm6M25KHESRsXJfei9etG:dGZdysXHYj

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DataLinks\ = "DataLinks"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89808b6926dd83e93b3db9c28a90b55f5b2b4312b666138e469ea55cfb7614ff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89808b6926dd83e93b3db9c28a90b55f5b2b4312b666138e469ea55cfb7614ff.dll
  2⤵
  - Modifies registry class
  PID:2360