d8f3fedde975e393530b694eee1ef9c981b48bc46b4e24749c20189a6fa58e79 | Triage

Analysis

max time kernel
13s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
18-02-2021 19:50

Sharing

Report Analysis Logs

General

Target

202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
Size

430KB
MD5

e31f19e922d23d120305a0f4814f823e
SHA1

e78cea0939f886834af7844325baf57f500556ed
SHA256

48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f
SHA512

7fbec934aa980951c4b05eaa2544a308effc9c4ae7b3f8ef82a7c10d294f96c2a41537eede8b2afe8f20683979145b33cd2e4e5a19ea76ce5f02cf1a0712f555

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4768 wrote to memory of 4944	4768	regsvr32.exe	regsvr32.exe
PID 4768 wrote to memory of 4944	4768	regsvr32.exe	regsvr32.exe
PID 4768 wrote to memory of 4944	4768	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
2⤵
PID:4944

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4944-2-0x0000000000000000-mapping.dmp

Download