44ad701a6e46ca32196d40d648e354b5ccedb9949f232e24290e80c3e12ae965 | Triage™

Analysis

max time kernel
42s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
25/11/2020, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CHoyU.pdf.dll
Size 159KB
Sample201125-2ac45168mx
SHA256 44ad701a6e46ca32196d40d648e354b5ccedb9949f232e24290e80c3e12ae965
MD5 bda796ca4c1bf2886e3ce77f64771b5c
SHA1 5cd6845ab197adac6cb50788a6d3c15b7509fd89
SHA512 4fab9cf9712fc54697fe8bb04fe467bca106e898436cb7a93b31ee6ec61a010cdbeac98e5e8dc5797208480692ce022ab42c0bbce19731251a03ff63079002b1
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1968	1588	regsvr32.exe	26
PID 1588 wrote to memory of 1968	1588	regsvr32.exe	26
PID 1588 wrote to memory of 1968	1588	regsvr32.exe	26
PID 1588 wrote to memory of 1968	1588	regsvr32.exe	26
PID 1588 wrote to memory of 1968	1588	regsvr32.exe	26
PID 1588 wrote to memory of 1968	1588	regsvr32.exe	26
PID 1588 wrote to memory of 1968	1588	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CHoyU.pdf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CHoyU.pdf.dll
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads