SUSP_CreateObject_RegWrite_Combo

Rule Info

Rule Hash
9c3968d7730db9e8f48e934b379c634c
Score
75
Tags
['SUSP', 'T1136', 'ANOMALY']
Reference
Internal Research
Name
SUSP_CreateObject_RegWrite_Combo
Date
2020-04-17
Required Modules
[]
Author
Florian Roth
Description
Detects suspicious combination of CreateObject with an inline RegWrite
Minimum Yara
1.7
Av Ratio
26.63

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
73
Suspicious (< 10 engines)
49
Clean (0 engines)
11

Rule Matches

Hash
Total
Timestamp
Positives
VT
2128774b8ebbd12453690e0f5e2c1472aa8815f65b13b217d2175588fad5db24
58
2020-08-02 12:23:21
14
a9f8b1a26666792f1902f8fb4c469d4f2fd899143844ace61299e2683435f765
58
2020-07-30 11:33:00
7
0c0232c03c8ef02fc88871a0aba33bd98433825e664fbc154f9d575bf4134910
58
2020-07-29 11:18:50
7
a587893ddde6206391e3241617542808d6750098f07d780f8d959a21ab87f549
60
2020-07-29 10:00:55
1
3b78e71aa4ec3698f6ce449dafaa278096f5c36672ffef6ab85d2e98c423ee6c
59
2020-07-25 20:04:10
6
b98bda00a1ce9a122ac2b0d666572c2124a5f24faadadf77f42c64e02cbaf352
60
2020-07-25 10:51:29
0
ac835658d6a789358a28878e18bff1bc56381157d31861982a54375ceaf7d49f
58
2020-07-24 16:59:59
1
77f27255a739dd6595cac66600fdcd3b1cf48b5022c3fd2a100a807184086721
61
2020-07-24 16:55:44
2
527539a3492d3306704e8da074ff91e0d1255184c1faf481bb156766e833e1dc
58
2020-07-24 15:03:03
5
b9c0d7baba8b0389f160a1c5f5d5db10de67894bd3894e34f625131ade150395
56
2020-07-23 17:08:56
0
60c86063327d5d4f632c0e78f103ca89c630078f80048ac8a932a4ef39a02955
58
2020-07-23 16:48:49
1
d3f8014505f5c9560ab4bfa17945f4d82c54f4f5143b17b9698c308b29c229fa
59
2020-07-23 14:46:34
5
e85ab54e2e8e9d5f5cda4088fe039d4247248d9f0e969ecea8da2e6420c8ed87
57
2020-07-23 13:34:00
3
1029bfa4f9b3e900af46dd9e6b1f9c0a22d834cd22ec16a560f2107fb3a5c5b4
59
2020-07-23 13:32:10
5
9e8670d87fce671fb875a81e6f9fbc4c9c2c1f30ed41fb6c2abb802be70318bb
59
2020-07-23 10:14:55
1
83d366c95024ef189ee3cc8d9cb07cef65e25f949ea2938c9484fe78afd63f75
60
2020-07-23 09:19:33
18
c9534dcc4c15a9aabd6f043ea213fe8677cab52cd34cba68373825bfbf7d64a6
59
2020-07-23 03:00:47
1
3a61af298d0cc139cdae38a07a6c139116a23808368767d1dd5d998edeae6fbd
62
2020-07-21 23:35:54
0
2aafec48a51356c224f819b6a54ca5f14fa827816f5ac76968995de3d52c4899
60
2020-07-21 15:48:56
19
cb1e642072731b8235c8069984cc08d80459d47ee83cdc93e6f852e60bfe7a5b
62
2020-07-21 03:00:25
5
f748018dffbc3128821cbdb687cc0d8ccf520f52699a6905f3f5f8e9f4d1a594
61
2020-07-21 02:48:15
6
7d46a8e15039483714887dfed42b1e98196722d8e9e7331fee667c899244ff37
59
2020-07-20 19:31:50
0
65caa177ec5cda015a87b285759fd0a770d396cedbfa016363d8f9773904fab1
59
2020-07-20 19:21:24
1
216c791bcbb9aa7e79150f5d7ed92ab54e2e0045b33b2e0ed6d45d0c50b7a65c
59
2020-07-20 15:54:03
1
a4cc4c342aa5ef1b8fa5b02eeb954bb633e972436e148dd7bb9bd64136188111
59
2020-07-20 15:08:51
1
39680cd41d47d9c3b8c20dffe2ccb8bf5667e471a6c3ef73bb07757b35974392
59
2020-07-20 14:17:24
1
ba63ed8ed3b0ec94585e3c7cad605f343d0a6f7f252bc12908442d3f956ce6c0
61
2020-07-18 11:54:07
22
99e2ddab936d80f6a1b1e3537039732d9b9dfbe67a6025abf723695061ddce6a
62
2020-07-18 11:51:50
22
66b032a954f744b00b91b99a2b2fb3f63a35ed23ff1e061ecaa24cde434e3c44
53
2020-07-17 16:01:01
4
63523f5160f8c7ea1dff025714acdcc917a6eedcf0d95196e970a79a653caf2a
61
2020-07-15 15:34:49
25
0c25276d58a251c42e1a4fa8f2416af88b09b248a9b99dbf039670e2a288a803
60
2020-07-13 22:29:50
17
64598cf5aa2c70f3c3b523374f1fe2b93b76431e47e3b301181d4117f6976a13
62
2020-07-13 17:46:59
1
e221f9ca6a04104975b22de383213257156d0e29448540cc00d6b40ceacac16e
62
2020-07-13 06:51:27
4
240fcf6646b76c97fd6db3f3cde7525ba153df9b7a0dfdcea1350e921635e0d6
59
2020-07-09 20:25:15
5
abe611e9c1f06f2a5540eba35c9eaaff91dff580d58cbcf660f170eecddecb25
59
2020-07-05 21:48:36
9
0552e194977ae9cc4fcafbc399edff6ed9dd0f3438eb9fc045fcccd1893cf8ee
59
2020-06-28 10:39:29
8
8f55ec84019b5c24495b00453063f5462aa3bcb974f2188b76ac8d845d3e9784
62
2020-06-25 18:34:37
4
fa010b14f42c00c0ed93c8b5f8abc36c43e8fd90e3beb13c65e52e4641ef74bd
60
2020-06-24 20:41:59
10
6974f46ea9e60356cfc3622ec2434ba3b190bfee643a588b152f6d994da91269
62
2020-06-24 02:29:01
14
8681d18e29730857432356e8f6a501094e742a72e694fbf6bc01c72c07ae5963
63
2020-06-22 21:59:23
30
4ea62ddd8b8f474392fc0a0b8f1c488ae4d9760021852b3eab87ab918a0ffcbf
61
2020-06-22 21:42:05
27
0ce387495587c755bc428ab690021ec7669c54b8b2ac03b5242e2d8f82c323a7
62
2020-06-22 17:47:18
29
732691ba58ea8f12ded755adc77079b2070f772e982933e5df38a2607ab6e753
63
2020-06-21 17:22:22
28
75a3ed33a7ec8abc2aa0cb060a2900cbd8db451e81293d13c4c89a7d8af1745a
62
2020-06-20 08:55:19
28
477ffb29671609c0eabba1e1881639db60a7142ace46a1398c538accc40f1759
63
2020-06-18 14:27:08
28
9176f7f086b149a36278a6a0a3641624e72309164e90915975b93e8d0f73e9fa
62
2020-06-18 13:19:28
4
d5c31851e6421bff806387d734399e01348829d2c28b58d03c8c9cb9fb73e51a
55
2020-06-18 13:13:55
29
261b87f8776785b19a662f29e7aef3287d13cfe5b92ca6ba24dacb9ab62a431f
63
2020-06-16 18:59:30
13
7bfbfbe99bc8dd477c0cbf570729482c194618f68f3811789ea458bda58b85b0
62
2020-06-15 10:59:19
29
4c83fef2bd3aef73938c8556c7bce1adf6e70420ec19c96193de3a5496653129
63
2020-06-15 10:56:35
32
98c3774b483d7a7c5f56fd234f479aee44686d4ccdde0f794660510dc46a8e2f
63
2020-06-13 02:28:04
20
844ec0400310d299d31d7eb30cb10fc1eba13f648e87add8a0da81ca962c6537
62
2020-06-12 20:15:34
18
585854e340bf08d370342eb004c70833097bda59e1995580327a46dae0aa85a4
62
2020-06-12 19:27:02
23
5ba5553f897af92cd016640d52a7033da7906d74b5f495494372be9e3ba8ba4d
60
2020-06-09 12:19:17
27
da529225ee2b799d822c0655d87ffc8d4d2c89352a2e5892b247995773833329
61
2020-06-09 09:37:46
36
e2566eb542898662f5a8a5717d7990e988ebaedb2445fe4f3bf0dab166e13e5c
60
2020-06-09 07:08:31
31
cabcb399ff257f6108c5cc5f69e813f7f7c5cbd58a35742c1341ef3cbb99520f
60
2020-06-08 13:59:32
40
992d04a269ed9dfc31206182a109fa10755465681b382efce1a36ba5239b2fc7
60
2020-06-08 13:41:04
39
3adcb8576f312311fbe099b2553f88a213a49638df1499c0ec175c091ee7a9ba
62
2020-06-06 07:48:45
33
7c3fb236489c2a1fd179c677909b59f1122d61e94c8559e8af352ab95b15a465
61
2020-06-05 23:40:20
32
5851342a837cf8caeb869810cdd4ba5726ad6175bb8afd01a75bc5a27e5edd03
61
2020-06-05 22:56:45
0
e83a0df0dd16b36830e26d576102572017c4de3040eea70ee7e8bc2f3e53d86f
61
2020-06-04 04:21:27
32
aedc5b61b1b6dcf79f95a34d026b430188a79219449bc1af6dcb8966b61f08b2
61
2020-06-03 07:13:53
29
a191b62d1a8d898f45c70f1bb4db039bd083105da33743968a127ff7fe366825
62
2020-06-01 09:51:47
26
773aaf02309e1366b6bdbd7a22e50092dc679cdf46b6298ce2b7074f0806388a
62
2020-06-01 05:39:59
36
7930e82b26a186fcc36219923215857aa4eb6d0114b07d9622dd2e1243716156
60
2020-05-31 04:33:02
28
032ac8c773399ba97a216770ac6fd20326eae603370c7219827cd7c1d731cd1d
59
2020-05-30 21:06:06
7
be923defe1ec3266a9aca8d2d9410e0f2b822fcd251e0ba5b8a6d694eee5b8fa
62
2020-05-29 06:55:26
26
c4f16b83a8de68b2c88f69b07486f828a45c37640a7d33c6146078f52630bb35
62
2020-05-29 05:25:15
20
15de752c19eb3c8209e61ec31d698bad9f455d507f65889c5a1a39b91e2e376f
59
2020-05-28 11:20:12
4
23fe68a7d8116fbf6eecca4be38f9d2282ee8662c956a97279850b2f7823b21f
62
2020-05-28 06:30:05
26
9f6091ff8762fd9149e55dd0f04d819ea796db03f2a54d7f8cdf573452117917
61
2020-05-27 12:30:11
25
771934328b04a00dba2c00bbae48036bc1a627193421e1962ea0da75c62d27ef
61
2020-05-26 17:52:10
28
55a1b89c50c87265d19109bbb1f31d2394bee1166bb26567921334430157aac9
62
2020-05-24 01:08:07
21
071b25368888e9060c55d3271639194a5ba397fd6cee81285e8ebe48858b8107
62
2020-05-23 22:02:11
24
a69d10080316f499765460ef0902e2a5617e1c377254b900dfe02cde08c23d5d
59
2020-05-21 20:41:32
18
ee81909d5e9f251df6b4dec57f7aa3accb3a2fa8ff52ee0685d488a589c4a725
71
2020-05-21 18:15:46
54
756a6f71c4f4378ee001f4e5ea8b002114e972817b040687014ea74e69a72ad2
60
2020-05-20 20:32:50
6
998b8693117c51060bf58c846ac6fa648007be7b98bd19f183c70cccab8181a9
63
2020-05-20 10:37:42
25
787a9d1220bbac93a71b6746e2def98904b018533270220e32aba56bb5331b4f
61
2020-05-18 13:54:25
28
5c94d6aac75457f4d49700ac7a06c02bd6b4b6c915b54d2ba91d5bc4b89e341d
59
2020-05-16 20:46:50
10
a458a76d1bf9f662694ca2055c2121b3542ce2e483f2c5805a1cbad3e9a13d0a
61
2020-05-14 18:06:55
28
a3170def8606551f4ec2c72305011fa36cc14714901540238243840eb1528c61
61
2020-05-14 18:06:11
19
14e41b0871bedc561939e707e6e082a5028840ba06dfebb11917be5991040655
61
2020-05-14 18:02:45
19
87d47c7ad2a8e1db6fb778f40c22e7a5c28373ef22b41012c995fa8617cea3bc
61
2020-05-14 12:29:31
28
2ae2db5d09c6be84a4ad00b534c1dc78de487c429aa0acf5ee104f9d3d867f81
60
2020-05-12 12:34:26
29
fe39954bf488e906843fd3c944a9cf12b8815c81b3f8365964db9d3c34f82338
59
2020-05-10 17:26:36
0
85f7e45904e059698dca69aefd0f49c1ac7434703f6d4eb913e95de5b8162df6
61
2020-05-09 23:09:37
36
a9a4c49be30f308413557b64b0831b90b1237cc72067e166c28a11f87c243d67
61
2020-05-08 20:48:16
34
8f4bc2bf6f4e5d387edf279415638890c5c35af3574546d0d281d0f5f49573a2
59
2020-05-08 20:08:48
5
e5b2c6c1cebf0d21adb976618be1755a618b3b57400d95cf1fa9b740ca24ec1d
61
2020-05-07 19:13:40
2
6ca76cfaaa30bdb1359e67e966ee7e7990e47619fcbe0c5f642bce93404f3cd6
61
2020-05-07 16:24:06
24
643a74d3c72b4fe1932822b7ebb3e2268b55fe48e1161d52fdf027989f2f2526
59
2020-05-07 06:52:58
6
2564fa4db1d94e365980f0cb484ae4f694038c446cf49b39c34d056e05e3a997
37
2020-05-06 14:04:28
0
0d10894c9db472ed58b1d8e46bdd257ea6f540e87aaef07acbe97433d8353042
58
2020-05-06 13:53:20
0
e4a32946a84ec85e8b51f8a4b12c8d2f9dc76cf67a8795d312e475802d24c393
59
2020-05-06 13:52:17
2
2baf1f47a259a71abdfdb6bc3e366f2bb89266bdd6fb8972f0f3166189dfc405
59
2020-05-06 13:50:08
0
98fa18a3616ca30f2cf6500459196dbee95c9ae774ad594b7daf05999bf247d0
59
2020-05-06 13:49:38
2
d7e71915bc72b8d8ba31ee8e35039702091aa39a7281dfd719864c06ff57d93e
59
2020-05-06 13:48:45
2
7a202a4fe5ade3a63f0fa1fe32adc343b885fb1c43fffc5741bd45b7875c3919
59
2020-05-06 13:47:44
2
f08a829ce3171bc745eda20c6bcdcde30546429aac2d26de8f7a07451a255a92
57
2020-05-06 13:46:19
2
c5754bfee5a79a05f68ece2598df4df047108e6a16956d880884a57d1208ab64
59
2020-05-06 10:14:08
2
63208ccedc39d2bc5b6cd6e7fef9bc74943367dfa1579d76c2b485eb650d2e51
58
2020-05-05 20:04:11
0
130efbdc97bb93eae773730a8bfeb9cc49930fb192aade45c79d693ad83a3f20
60
2020-05-04 23:14:45
27
ce38c6f757f68dc6fec28a73c8a3aa8f366737aeb9fe4cf1674e5f5792502881
60
2020-05-02 19:02:24
32
de0cb0e945b09d3d33c5a97daf517e6c8fab67243cc8109781e49cf46cdf4b67
56
2020-05-02 18:59:42
28
733b3e58c8b7280cb351539dfd4f0cf57be967a595a4ac237369f6f80a3be926
60
2020-05-01 10:24:13
33
af70b67e70ba11e54deefc140b9fda0e7fe918f8bf1cf19eb184278c20ded621
60
2020-04-30 17:30:51
24
ee913965822c4bbd2454a497431a82cb9d5fb360f51f313519fb132dc0532f67
62
2020-04-30 17:29:00
31
a4931fd893b630efa9b4cf7c7ca1a1b7827ec2cef7d270baaa7737b4103be235
61
2020-04-30 17:22:57
30
23d1a8e46a5713a39a7d636e9d22d3c24237a09f51248b7cfc421e99056c5c6b
59
2020-04-30 11:20:35
23
39d059d7891d0b194face48f21093f6de9ae14e3f788f8a30c128398a0bf545c
62
2020-04-30 11:17:54
32
0eb1f2c85d6c1fcbb1546cec47d572245e291f3522e5fc49cfbe47f9415c8539
61
2020-04-30 01:16:24
29
40d72cad9e7c10eb1b2415148cd641f8425419ace468ee3f418849d9675b8f0d
62
2020-04-30 01:15:44
32
cac81dd6d21cd8011f819fe998684e5f91710661b5cb7a2598fc0623dbe2b1ce
60
2020-04-30 01:14:28
30
1fc6f05a4a0947806e0c77492c6afe5a4f8ce20c4450ebbf2eb35818f8962210
62
2020-04-30 01:14:28
31
6c6d611e629030213f065c058a969d3f19f91dfb2fe78c15acbabb9e687321ed
60
2020-04-27 09:22:41
33
cf455db74b46b3f14721f9c225669e5577b278c31210d2e3941de8b8ccfc2f00
58
2020-04-25 18:48:49
8
30cbc765accb5585c3379b970e1e9c748d23b8b4baaf5427b315043079f220db
60
2020-04-24 21:35:31
7
c0d4a6ca8d7247178793e796a0dde778ec27eafaea347124c88b18c4f0055161
61
2020-04-24 12:39:44
2
a2526a8acfd4868e32aaf80495b29523914b92cb34021911e003336ec3604130
60
2020-04-24 12:08:36
29
729a51a5f2323366053f96eac7cdb518fcff060236bb50d9320e1876735f876f
62
2020-04-23 10:18:53
24
f4176cc1e7033e29949eb8f635aeb37bced6e1620ce6f62d4b60be40acf199a3
62
2020-04-20 23:03:26
0
72fef870ccd8375d783ea107b7147c4052b15f2846e6c77c80d1174825a0fbd2
60
2020-04-20 06:27:28
29
66c1aae5dc4cf18186adf8a66cead4b03496c76f737905ddb4975965854554df
62
2020-04-20 06:25:15
27
75bab2aa53dd7d6285033fb063c980c4dee820126f3dad2f5c8c7a2d8d05147b
60
2020-04-19 20:41:25
6
9989876bf7380a98f4b4742dd7bf9b417693cc721dac438f8868e7952feea0da
60
2020-04-19 20:39:02
6
d3401049e44b2891e9f213175fb5d94961ed977c80c1861048758e2193267331
59
2020-04-18 21:27:04
6
c7cf4fa8ff25f70481ca9d34950c207c77ad1e75966cdc69fe7a7ee45a714ef9
59
2020-04-18 21:26:26
6
61b1154c9860835fa219a8163deba5cac20d4cca6d4a7d84fb623087efe71379
62
2020-04-18 20:38:32
30
af30c82b2c8d37eb7237ae4a0c5fb708fb136a4fc6a3bcce3b2effe6d68df05b
60
2020-04-17 21:38:25
6
6c09668f66c7870d0e0ff8eaefa88128a5e5f246b3234a0cbcdb31097df159a5
46
2020-04-17 21:36:18
5
c58fd76a1f4e714823b7442dff04803f7f184283fca13f327c5a7e0c46067572
60
2020-04-17 21:26:13
6

Rule Matches per Month (last 24 months)