f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:46

Target
f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a.dll
Size 593KB
Sample260729-yherqseq3s
SHA256 f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a
MD5 982a04e87ee9784ae34a059f94e13c47
SHA1 143de44afc38923c93a7d3c312c12e98378ac7c5
SHA512 a3085c03a9d0110c2e7ef12af8c40e2ccd38392ae6574cb1a1c0ebfb0defdaf227f1d4f36be697d9ce05f4014c0cbea13a07f9c4ce7d55e3349cb8e8e4be6d34
SSDEEP 6144:I+Dh1PrCbTsyit1xj8niAhoDsAiv5pTGBNN9hR5wKHqj6f3rdJhnt/eGWv4r4BMF:I+d1TrtAiUXTsN9hMjsLeJMqj4zWY
TLSH
T1AAD46B5238D514DAC13682F2CF93E1749713FC781DA4852BA2CD2E165F0AEA12D63EF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5860	regsvr32.exe
5860	regsvr32.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/5860-0-0x00007FFEB7A0E000-0x00007FFEB7A0F000-memory.dmp

Download