438af114f61f080e11ce146ce623487af5195f6e68e8da89deb7838e72404bba | Triage

Analysis

max time kernel
54s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
13-03-2021 09:50

Sharing

Report Analysis Logs

General

Target

microsoft_shared.tmp.dll
Size

686KB
MD5

7a75045c4c927433aa7258833355c403
SHA1

c9fb3583b403cc8ed0186971ee300629fd91525f
SHA256

eb12afe158fd7f4236a98c7c6b686dfe9838c3d986c28b593a54303c68534661
SHA512

e1ef63423f04f0047a89b72537aa6d0068e842304e69146e766e83a7b261025765944858d699480f66d38655c4fa5e20b04e96fff9a0397f27db92016cb2c02b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 692 wrote to memory of 3992	692	regsvr32.exe	regsvr32.exe
PID 692 wrote to memory of 3992	692	regsvr32.exe	regsvr32.exe
PID 692 wrote to memory of 3992	692	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
2⤵
PID:3992

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-5-0x0000000000000000-mapping.dmp

Download
memory/1292-6-0x0000000002BA0000-0x0000000002BC6000-memory.dmp

Filesize
152KB

Download
memory/3992-2-0x0000000000000000-mapping.dmp

Download
memory/3992-3-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3992-4-0x0000000000530000-0x00000000005DF000-memory.dmp

Filesize
700KB

Download