e6aa51593afeee8e7f80a623dbf83d398cddabb2d463ee8f916906a504f89a45 | Triage™

Analysis

max time kernel
40s
max time network
70s
platform
windows10_x64
resource
win10v20201028
submitted
30/11/2020, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
flsYG.pdf.dll
Size 237KB
Sample201130-hn2425zb8n
SHA256 e6aa51593afeee8e7f80a623dbf83d398cddabb2d463ee8f916906a504f89a45
MD5 aba5e929f86fb248691bfcf725e1f446
SHA1 dbcb98288ce51b7e310b423054717724e28bd84e
SHA512 dea691cf0bb9f8888612eae616945dfd86c67fad47c400641e26b8e88b345d2c37c821947c80c57fb8780ea41efd045532ff428ebb3c8e7bd1ed99f709feae4e
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 3960	884	regsvr32.exe	74
PID 884 wrote to memory of 3960	884	regsvr32.exe	74
PID 884 wrote to memory of 3960	884	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\flsYG.pdf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\flsYG.pdf.dll
  2⤵
  PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads