Registration calls wrote COM values despite a separate DLL error
Sandbox records tie registration-related calls to writes pointing three COM classes at a desktop DLL. A separate call generated Windows error reporting, but neither that error nor the writes establish whether the registrations were later used or amounted to a hijack.
Three COM class registrations were set to point to funoictl.dll on a sandbox desktop. In the same sandbox report, a separate invocation of that DLL produced a Windows error-reporting process. Did the component fail to do anything useful, or had it already made a consequential change? The evidence supports a more specific answer: the DLL’s registration-related invocations produced concrete registry writes, while a different invocation encountered an error.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read