Analysis
- max time kernel
298s - max time network
299s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
185272.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
185272.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
General
- Target 185272.dll
- Size 67KB
- Sample260424-mt58aae14w
- SHA256 0b9928e96747fc4e418a7e4e193132dc7dee6c65439a74f0d5df6483f38d08e0
- MD5 d46d111419fbcc802bba32fa0165ce7f
- SHA1 583275bebde7ad95f9feeac598cbd85f490ec3fa
- SHA512 85cb8a12da5aacea2a1e210e893dad8b4dbc465d3bfc382c3c1843ae165ac20b5e070846c324b4018c3946b6af8e61d2258d3b631d90bd4e4bc5e14db6f9e790
- SSDEEP 1536:dnI8Tku1bhSCk0fRehwVRtdlTURgTqOgPzc/9/8DhU853S:Ph+ueheRtjURgTqOgbcCDhp3S
- TLSH T1526339227A81D172C8D61071099EA2A62979EF615F6356C7E3087BCFEC743C0AB34797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\WOW6432Node\Interface regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PenIMC.PimcManager.2\ = "PimcManager Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54A05253-96FA-4B98-B8FD-9534D7255914}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54A05253-96FA-4B98-B8FD-9534D7255914}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC09F8A-CAFC-4F0E-9F75-4C87E21C6653}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC09F8A-CAFC-4F0E-9F75-4C87E21C6653} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65589CDD-97E1-4799-8DA1-9547BBE656E6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\ = "PenImc 2.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\185272.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PenIMC.PimcSurrogate.2\ = "PimcSurrogate Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54A05253-96FA-4B98-B8FD-9534D7255914} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54A05253-96FA-4B98-B8FD-9534D7255914}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54A05253-96FA-4B98-B8FD-9534D7255914} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65589CDD-97E1-4799-8DA1-9547BBE656E6}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65589CDD-97E1-4799-8DA1-9547BBE656E6}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6AE27784-B62B-4701-861C-6557E3D740E3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6AE27784-B62B-4701-861C-6557E3D740E3}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6AE27784-B62B-4701-861C-6557E3D740E3}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC09F8A-CAFC-4F0E-9F75-4C87E21C6653}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98B8C4DC-D88F-4E3D-8823-D632D6FFCA41}\1.0\FLAGS regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4176 3156 regsvr32.exe 80
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\185272.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\185272.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4176
-