75a55cc7c014e09a9d0ef42ec00fac295f380c933cb9c2ee18ed1d584d2c64a8 | Triage™

Analysis

max time kernel
42s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
30/11/2020, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RpLBT.pdf.dll
Size 237KB
Sample201130-nx7cnm7eqx
SHA256 75a55cc7c014e09a9d0ef42ec00fac295f380c933cb9c2ee18ed1d584d2c64a8
MD5 918d6da63a83cb9f4924be57a55ba5cc
SHA1 fdd5a6b780b0f18905025abaef61297501e27111
SHA512 eb7eebc596465cf74afb248212cf345877f291f9851601eebb01ff76f0f9a148dd28fd3e0443b95539e117ef07e694d226df3b3d2a70b02d73b5132faba84cf5
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1348	576	regsvr32.exe	70
PID 576 wrote to memory of 1348	576	regsvr32.exe	70
PID 576 wrote to memory of 1348	576	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\RpLBT.pdf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\RpLBT.pdf.dll
  2⤵
  PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads