7d7ee0e33727d9db6fe70aaf56f3e4ecea1a7a01e4880586384e25ab07e3927d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:37

Target

$_95_/$_95_/$_100_.dll
Size

620KB
MD5

775d1655dcef4aa65ebf89e744e511a0
SHA1

664270a860ddb3d6f23f617d0615070330a71a30
SHA256

77534e52f8b0165e1230625fd7b938a88cfa6c965053e88ee47406e7f3e5dfb7
SHA512

ea7c366fc7f7bdbc20059007f0cbe2960be2ac07416488e47ac1b4ea06e130f3ec64377b86c0d5618858eedb32219c17936a2e5a0fa6bcf1683d181803a59c01
SSDEEP

12288:0mS9LkU6RYB/RHdkd+l66dvxcyxgxkSkWtSgFPIxGy9CaRKahB:tS9LkqB5dy+lvdvBdWbFwxGyUaR5hB

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$_95_\\$_95_\\$_100_.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}\ = "Conduit Community Alerts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1408	1124	regsvr32.exe	31
PID 1124 wrote to memory of 1408	1124	regsvr32.exe	31
PID 1124 wrote to memory of 1408	1124	regsvr32.exe	31
PID 1124 wrote to memory of 1408	1124	regsvr32.exe	31
PID 1124 wrote to memory of 1408	1124	regsvr32.exe	31
PID 1124 wrote to memory of 1408	1124	regsvr32.exe	31
PID 1124 wrote to memory of 1408	1124	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_95_\$_95_\$_100_.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$_95_\$_95_\$_100_.dll
  2⤵
  - Modifies registry class
  PID:1408