617f845935d428ecaf15057713f3d08a10f8257b90ee669a2afac591678bac30

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Video Enhancerv2013汉化绿色破解版/VDFilter.dll
Size

104KB
MD5

29814a1ac8ec1ab19c63a46adf0f162a
SHA1

6c98ec4842dc238e909371bce52f234c6860972a
SHA256

03056fa466498f1d2edf29c2a27774b99a10891fb8dc15d0d695de912d398b4c
SHA512

dc4dfa399700447b0cce52a403baadeea680c81dd19c0325ad6364d62083168ba016c4e342f982c0b1c32efb88340bbb29fd5bacd4c5e8c1293ae5dfc0a26e4f
SSDEEP

1536:SBAORqEvNMlPrdh0ptnaYSoIng0hSuA+hVQDfHe5KSrLG0jkjA2:yAylvNMlPr/0ptnaNg0EuAs95KSRk82

Score

1^/10

Malware Config

Signatures

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\VDFilter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\ = "VDFilter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\VDFilter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\ = "VDFilter Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\FriendlyName = "VDFilter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\CLSID = "{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilter.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\VDFilter.dll"
  2⤵
  - Modifies registry class
  PID:2316

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads