1ac32cdb8b9969bdb69f97fbfc8f65aaa6bd0f65ee068ff99e6a4e4b073c51fd

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 06:50

Target

$PROGRAMFILES/QvodPlayer/QvodBand.dll
Size

85KB
MD5

1b1bdb8295c4a1705f92dea9bef53efb
SHA1

5f3790e649e44d98f18c3508b39952f65422796c
SHA256

104b370f1e7c3c014c54b41cd196e4922e4005a3b3ac7eb318c57047df13bf4e
SHA512

26c2f5376e0ff3ff0e00b18fe87388a777c4658d752d2a9b130408842f166b304828af656756d43ef5521c8ac595b19f28f714589177971dcbbcca08caf840af
SSDEEP

1536:fxsS1aqWpd53AtTNfvJrXffRqVCR474T1lLyNrT3UM:fOSUqhPvZXfYvET1lLyNrT3p

Score

1^/10

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\QvodMenu	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\QvodMenu\ = "{9F44453E-1E46-4D5C-B57C-112FF2EDAE82}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F44453E-1E46-4D5C-B57C-112FF2EDAE82}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F44453E-1E46-4D5C-B57C-112FF2EDAE82}\ = "QvodMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F44453E-1E46-4D5C-B57C-112FF2EDAE82}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F44453E-1E46-4D5C-B57C-112FF2EDAE82}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PROGRAMFILES\\QvodPlayer\\QvodBand.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F44453E-1E46-4D5C-B57C-112FF2EDAE82}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3024	1940	regsvr32.exe	30
PID 1940 wrote to memory of 3024	1940	regsvr32.exe	30
PID 1940 wrote to memory of 3024	1940	regsvr32.exe	30
PID 1940 wrote to memory of 3024	1940	regsvr32.exe	30
PID 1940 wrote to memory of 3024	1940	regsvr32.exe	30
PID 1940 wrote to memory of 3024	1940	regsvr32.exe	30
PID 1940 wrote to memory of 3024	1940	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\QvodPlayer\QvodBand.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\QvodPlayer\QvodBand.dll
  2⤵
  - Modifies registry class
  PID:3024