c30b4951a012f675f3d6d3920a255a66a97eb3daf61261f1fbf411324e41a371

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c30b4951a012f675f3d6d3920a255a66a97eb3daf61261f1fbf411324e41a371.dll
Size 4.5MB
Sample260729-pf1fzstdph
SHA256 c30b4951a012f675f3d6d3920a255a66a97eb3daf61261f1fbf411324e41a371
MD5 21bc556f5f2519bf0d13a514efd7df6b
SHA1 6f12d4d09ffd297673fea5a995756fd7f8b7b24f
SHA512 b679672dda14296b6538972b9c3db33027761090c0299a5a2d5b3b622a2fac3966a32b9e94265fe51b6e5d3deba2b5474f9df45935809445bad4c3d8d64833f4
SSDEEP 98304:/Z74Ma7QIacnJGws44BWdvUwoew5xoJuwE63WaGc0:xibacJ2woew5erE6mM
TLSH
T14026CF127DD14C7EE2D703344A1EF229A2EE97F42F28C40BE2C8DA2D39746526746D67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\ = "TencentVideoReporterPC"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c30b4951a012f675f3d6d3920a255a66a97eb3daf61261f1fbf411324e41a371.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\HELPDIR\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\ = "IUpgradeHelper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\ = "IUpgradeHelper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\TypeLib\ = "{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\TypeLib\ = "{50CAD4C0-6A1B-44A4-A4B8-74FB9FF4FCB7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED4613DF-4D86-45E4-8767-B76513FC9531}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2564	3036	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c30b4951a012f675f3d6d3920a255a66a97eb3daf61261f1fbf411324e41a371.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c30b4951a012f675f3d6d3920a255a66a97eb3daf61261f1fbf411324e41a371.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads