1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf | Triage™

Analysis

max time kernel
12s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
10/11/2020, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf.dll
Size 192KB
Sample201110-kang5nts9x
SHA256 1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf
MD5 2ec40a34901561ad5d673edbc6161562
SHA1 fac144b3a6b9ff60637725fa7cd231c701bfe8b0
SHA512 a3a9da54ce09967c7cd6cd14c8ac345a42bdff056866abf82bd8484d3c907f74b9011a0bb2ca25ae943ff11d4415080cfe0b2c126c21de1f28e8331e92e6167c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 5020	4708	regsvr32.exe	74
PID 4708 wrote to memory of 5020	4708	regsvr32.exe	74
PID 4708 wrote to memory of 5020	4708	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf.dll
  2⤵
  PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads