ccf311ab645f0f0fb20801a031b93935eddc6848e56e99f7420269438229c262 | Triage

Analysis

max time kernel
2s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
04-03-2021 01:27

Sharing

Report Analysis Logs

General

Target

1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf.dll
Size

192KB
MD5

2ec40a34901561ad5d673edbc6161562
SHA1

fac144b3a6b9ff60637725fa7cd231c701bfe8b0
SHA256

1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf
SHA512

a3a9da54ce09967c7cd6cd14c8ac345a42bdff056866abf82bd8484d3c907f74b9011a0bb2ca25ae943ff11d4415080cfe0b2c126c21de1f28e8331e92e6167c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1108 wrote to memory of 1904	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1904	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1904	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1904	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1904	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1904	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1904	1108	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1b81a3ffd4544dc7667376091f8cd5fbbe282bbcf71e39ee9c002ca8335548bf.dll
2⤵
PID:1904

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-2-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download
memory/1904-3-0x0000000000000000-mapping.dmp

Download
memory/1904-4-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download