68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9 | Triage

Analysis

max time kernel
91s
max time network
102s
platform
windows7_x64
resource
win7v20201028
submitted
19-03-2021 21:18

Sharing

Report Analysis Logs

General

Target

68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9.dll
Size

119KB
MD5

4f58e4373dd886d6da4268349437e890
SHA1

f3b8809bcc84051f1993b7d3f087a5dbf799e913
SHA256

68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9
SHA512

4e88e24bdefc2e21cf86a7fb12ebb744cb04c8e43c997438c176126c651d1a3aa254e3b47156cbc8f6f8fb8e69be6613b1d07411ad0cb5f37aa1a296bb8f6533

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 800 wrote to memory of 2016	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 2016	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 2016	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 2016	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 2016	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 2016	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 2016	800	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9.dll
2⤵
PID:2016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Filesize
8KB

Download
memory/2016-3-0x0000000000000000-mapping.dmp

Download
memory/2016-4-0x0000000076C21000-0x0000000076C23000-memory.dmp

Filesize
8KB

Download