e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33 | Triage

Analysis

max time kernel
144s
max time network
144s
platform
windows10_x64
resource
win10v20201028
submitted
11-11-2020 11:08

Sharing

Report Analysis Logs

General

Target

e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll
Size

282KB
MD5

736cbf4e5d86772965db0b0ed4e4b9e2
SHA1

c2701cfc2a650dfee8b5615216d161629662f9b3
SHA256

e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33
SHA512

7dccb38ed0c9662a2456a115921d3620efc387b59f22c30e3af870835b5aff15f1d20507403e1c5c97622cd9a379a847b458e073489fae886e4b35b619f48eab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4684 wrote to memory of 4832	4684	regsvr32.exe	regsvr32.exe
PID 4684 wrote to memory of 4832	4684	regsvr32.exe	regsvr32.exe
PID 4684 wrote to memory of 4832	4684	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll
2⤵
PID:4832

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-0-0x0000000000000000-mapping.dmp

Download
memory/4832-1-0x0000000002D60000-0x0000000002D93000-memory.dmp

Filesize
204KB

Download