7882eab29859c18474d3674f7802e17c2c78616f3dc9c5afbba04bd30db1b213

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:03

Target

CAD迷你画图/DWGViewInstall.dll
Size

91KB
MD5

f0c25c150a434f0918c8c6e087e9c41e
SHA1

06be3491fa4810320fea0ab337b717ba94bce04e
SHA256

9b67a5c58c59c84f5008ff5bd04c23b29f0ae7973d4b48642cb9fcbda042d893
SHA512

8553e0eae4939f33a516df00b320fcd30f628ea6bd77a2c54e0dd5b27d47067e3c5c5d9005000449d7b174ec071454064af80e31dc22087287327b119e9d9a57
SSDEEP

1536:ZvgOmJuUKX8x7Voy8lX9oRr3NrjJGcAkK0lxmMD1sXaIY3h9u:ZvgTJuUKMx7Vodl2RrdscZlgMD1sXa1u

Score

1^/10

Modifies registry class 7 IoCs

Processes:

rundll32.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwg\ = "ACAD.DWGDraw"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACAD.DWGDraw	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACAD.DWGDraw\shell\Ê¹ÓÃ CADÃÔÄã»Í¼ ´ò¿ª\command	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACAD.DWGDraw\shell	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACAD.DWGDraw\shell\Ê¹ÓÃ CADÃÔÄã»Í¼ ´ò¿ª	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ACAD.DWGDraw\shell\Ê¹ÓÃ CADÃÔÄã»Í¼ ´ò¿ª\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CAD????\\DWGDraw.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwg	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\DWGViewInstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\DWGViewInstall.dll,#1
  2⤵
  - Modifies registry class
  PID:2264