6610a12184a15e0fe2f3c8d2f730aa7a4497386a10487138cfe1e019ec3f1f2a | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows10_x64
resource
win10v20201028
submitted
24-11-2020 14:55

Sharing

Report Analysis Logs

General

Target

Accesshover.dat.dll
Size

105KB
MD5

8dccd1c176f6b855e1a60b710d38a9e4
SHA1

3b72fecbabd585947cd9cf4b5d9c3795ab798d39
SHA256

6610a12184a15e0fe2f3c8d2f730aa7a4497386a10487138cfe1e019ec3f1f2a
SHA512

6f743e1769624af220d54b5d1cba4e02f8868338c7503f311bad631af4ecc8983d75ad7ae953b71a973796e2669e9a2ef451459c836b7a917f7a175dc87cb5ff

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 416 wrote to memory of 1764	416	regsvr32.exe	regsvr32.exe
PID 416 wrote to memory of 1764	416	regsvr32.exe	regsvr32.exe
PID 416 wrote to memory of 1764	416	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Accesshover.dat.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:416

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Accesshover.dat.dll
2⤵
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-0-0x0000000000000000-mapping.dmp

Download