4eced79ab0c6c9ae5caf57c953a3ecc0eed3d6858e8c6084d7a8aa0db4e8b202

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PicasaInstaller/srv2k3/imapi2.dll
Size

416KB
MD5

dedc0278c854accf6cb44fd49f67f9b7
SHA1

ff737753d04cb47a0038a638b0c12650ec14c1bd
SHA256

739fe8b211cae8a8e8f505418294900ad86ed5a15b3f1608855002c658a4bf4c
SHA512

8afb4423773398fb47f5b01d38372bfa79eafb15f35c9c02dc68bc7ee75e02734cd52e2afa9bf9e38133ed9980fd1daf47d5ed73dc9e046238dfe939070baec2
SSDEEP

6144:AWvVwQJvqLaott0nmAo13pid1cYGpy7P/VHzX:JuQJvqLbD0nmAW3e1cW1

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354144-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354151-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354152-8F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354154-8F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354131-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413F-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413F-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354145-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354147-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354153-9F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354130-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354133-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413D-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354150-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354150-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354154-8F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354154-8F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413D-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354143-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354145-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413D-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354140-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354142-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354146-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354155-8F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354131-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354133-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413A-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{25983551-9D65-49CE-B335-40630D901227}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{25983551-9D65-49CE-B335-40630D901227}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354156-8F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2735412F-7F64-5B0F-8F00-5D77AFBE261E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413C-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354135-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413A-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354151-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354153-9F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2FFD834-958B-426D-8470-2A13879C6A91}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2FFD834-958B-426D-8470-2A13879C6A91}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2FFD834-958B-426D-8470-2A13879C6A91}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354135-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354135-7F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{25983551-9D65-49CE-B335-40630D901227}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354155-8F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354156-8F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354132-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354133-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354147-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{25983550-9D65-49CE-B335-40630D901227}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354150-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354136-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354146-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354152-8F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354153-9F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354156-8F64-5B0F-8F00-5D77AFBE261E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2735413F-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354142-7F64-5B0F-8F00-5D77AFBE261E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354151-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27354130-7F64-5B0F-8F00-5D77AFBE261E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2FFD834-958B-426D-8470-2A13879C6A91}\ProxyStubClsid32\ = "{27354130-7F64-5B0F-8F00-5D77AFBE261E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2FFD834-958B-426D-8470-2A13879C6A91}\NumMethods\ = "5"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1952	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1952	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1952	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1952	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1952	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1952	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1952	1864	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\PicasaInstaller\srv2k3\imapi2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$TEMP\PicasaInstaller\srv2k3\imapi2.dll
  2⤵
  - Modifies registry class
  PID:1952

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads