e5af4868fc46a5a675d9e93c4e45b9fef7043fe2263ad0bd9469082c00d74139 | Triage

Analysis

max time kernel
54s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
16-03-2021 10:21

Sharing

Report Analysis Logs

General

Target

1391343.dll
Size

500KB
MD5

c91aa7c80fa2e6fbf094040caeabca14
SHA1

aaa87f6e2b6f923df5aa4b92ebe70bb744d1f311
SHA256

e5af4868fc46a5a675d9e93c4e45b9fef7043fe2263ad0bd9469082c00d74139
SHA512

10bef80585a6ca2cf32c3a526aeca4072d108c8c488a5b5e9744a487cdfc48a1f3ce5935e33f7ae5b0d961e2b291c0c79c882df3f1a64f54c4adb6d49b1e1ac1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4688 wrote to memory of 4784	4688	regsvr32.exe	regsvr32.exe
PID 4688 wrote to memory of 4784	4688	regsvr32.exe	regsvr32.exe
PID 4688 wrote to memory of 4784	4688	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1391343.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1391343.dll
2⤵
PID:4784

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:3892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-5-0x0000000000000000-mapping.dmp

Download
memory/3892-6-0x0000000002D90000-0x0000000002DB6000-memory.dmp

Filesize
152KB

Download
memory/4784-2-0x0000000000000000-mapping.dmp

Download
memory/4784-3-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/4784-4-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download