617f845935d428ecaf15057713f3d08a10f8257b90ee669a2afac591678bac30

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Video Enhancerv2013汉化绿色破解版/Parallelizer.dll
Size

92KB
MD5

45980bcf966f8b8c838e63f608b69d49
SHA1

37ac91500f721fd85f2ffc8ea470e137a62bc1e1
SHA256

ff2afa38561667c34b23d0e0bcb4126f10d90e85dc95088ed2326c9de67640e8
SHA512

bf70fc62458bfdcc65499f965b432e0bce0f080ff2fdc9f9367d217033c8064d3b571cc5ee391f7fa1ab8a4cd94f5891e55296c8198814e1751ea399341c628c
SSDEEP

1536:VmAjw8d2xHkJS/cRqEv9XdTtITjTjKptxe+X7ZXKt5:VmAjw8d2x5wlv9fITLKptxemKt5

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\CLSID = "{CE012A8E-2462-4200-8A9C-AE57593B64EC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\Parallelizer.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\FriendlyName = "Parallelizer2"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\FilterData = 02000000000020000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000600000003170693308000000000000000100000000000000000000003074793300000000600000006000000000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\ = "Parallelizer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3064	2648	regsvr32.exe	30
PID 2648 wrote to memory of 3064	2648	regsvr32.exe	30
PID 2648 wrote to memory of 3064	2648	regsvr32.exe	30
PID 2648 wrote to memory of 3064	2648	regsvr32.exe	30
PID 2648 wrote to memory of 3064	2648	regsvr32.exe	30
PID 2648 wrote to memory of 3064	2648	regsvr32.exe	30
PID 2648 wrote to memory of 3064	2648	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\Parallelizer.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\Parallelizer.dll"
  2⤵
  - Modifies registry class
  PID:3064

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads