8be410717226b5e873c61a30d92a767c6c6492ce6358cd79b2a41cb23dba05cd

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 09:31

Target

$SYSDIR/mfc42.dll
Size

992KB
MD5

e36a58868f19b7b23374946356b3fe4f
SHA1

ee30af3baf6143474180ece33408ed72d6ff9f62
SHA256

2c4879b97eba1d2cf9398d675e94091fca2ffb08325d2451c8be661bf671020a
SHA512

2070650ffae2c10022a74f3f02afd3e85f3a4eab7075e1612acac854be1c6305a32d3899aa60abf01524f65beb97fff02042ee89b5eb9345551b42653a5a8206
SSDEEP

12288:Uk3DdssfXqxXzJoE0YlkWBVKLSjMrZhFV7LZmdWHtxFUy78CtZxbJ4oa/Z59wdJA:UAXqcXRpZrpL8d0wivBaf9wnvTrGns+

Score

1^/10

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 548	4476	regsvr32.exe	84
PID 4476 wrote to memory of 548	4476	regsvr32.exe	84
PID 4476 wrote to memory of 548	4476	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\mfc42.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\mfc42.dll
  2⤵
  - Modifies registry class
  PID:548