257c07e77ac98b8f3d1f08c549887d6f75bd603b9adcb0a1e4e7dda9bd886161 | Triage

Analysis

max time kernel
1348s
max time network
1350s
platform
windows7_x64
resource
win7v20201028
submitted
04-03-2021 00:19

Sharing

Report Analysis Logs

General

Target

257c07e77ac98b8f3d1f08c549887d6f75bd603b9adcb0a1e4e7dda9bd886161.dll
Size

244KB
MD5

04fd6daef19bb324ecabd0c1ea735fd6
SHA1

527c68208aa3282d39121d949f9818c3db12986a
SHA256

257c07e77ac98b8f3d1f08c549887d6f75bd603b9adcb0a1e4e7dda9bd886161
SHA512

7980d1ecfbdc229a70e90aca2daa73ba1465c96d570471c4d1e6cfd74a9a34c9a05630c71a1f5e65d8004b1457d0cbe8c40155e05ba06252696da071d48bd9f9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 872 wrote to memory of 1500	872	regsvr32.exe	regsvr32.exe
PID 872 wrote to memory of 1500	872	regsvr32.exe	regsvr32.exe
PID 872 wrote to memory of 1500	872	regsvr32.exe	regsvr32.exe
PID 872 wrote to memory of 1500	872	regsvr32.exe	regsvr32.exe
PID 872 wrote to memory of 1500	872	regsvr32.exe	regsvr32.exe
PID 872 wrote to memory of 1500	872	regsvr32.exe	regsvr32.exe
PID 872 wrote to memory of 1500	872	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\257c07e77ac98b8f3d1f08c549887d6f75bd603b9adcb0a1e4e7dda9bd886161.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\257c07e77ac98b8f3d1f08c549887d6f75bd603b9adcb0a1e4e7dda9bd886161.dll
2⤵
PID:1500

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-2-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download
memory/1500-3-0x0000000000000000-mapping.dmp

Download
memory/1500-4-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download