9443d7f2890e26024ee0b8067ac2609fcdbd4bcc6981a7ab1aa8671be232b1f6 | Triage

Resubmissions

12-04-2021 15:31

210412-npggt7hxze 10

09-03-2021 21:23

210309-r56tj9abm2 10

Analysis

max time kernel
2s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
09-03-2021 21:23

Sharing

Report Analysis Logs

General

Target

9443d7f2890e26024ee0b8067ac2609fcdbd4bcc6981a7ab1aa8671be232b1f6.bin.dll
Size

322KB
MD5

7c6e8b2aac5f2706a3d7660fbfb43c37
SHA1

4f4e68abbdd7d5af55e4a9e25611cc535cc5820e
SHA256

9443d7f2890e26024ee0b8067ac2609fcdbd4bcc6981a7ab1aa8671be232b1f6
SHA512

d324997e2e01e57afeea96d81fbc1d18b1af97823d26a650957665a3172061e623988c7c8cede8a1da887b766cef833f8bd428fbbd08b7346559cdb680ac46eb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1336 wrote to memory of 1324	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1324	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1324	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1324	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1324	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1324	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1324	1336	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9443d7f2890e26024ee0b8067ac2609fcdbd4bcc6981a7ab1aa8671be232b1f6.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9443d7f2890e26024ee0b8067ac2609fcdbd4bcc6981a7ab1aa8671be232b1f6.bin.dll
2⤵
PID:1324

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-3-0x0000000000000000-mapping.dmp

Download
memory/1324-4-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download
memory/1324-5-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1324-6-0x0000000000970000-0x0000000000A84000-memory.dmp

Filesize
1.1MB

Download
memory/1336-2-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download