8e5773268a41238cf4c2f0954e14ab305b490f305b7d9aa696ae11278bb9bb92 | Triage

Analysis

max time kernel
122s
max time network
155s
platform
windows7_x64
resource
win7v20210408
submitted
09-06-2021 17:28

Sharing

Report Analysis Logs

General

Target

8e5773268a41238cf4c2f0954e14ab305b490f305b7d9aa696ae11278bb9bb92.bin =^_^=.dll
Size

244KB
MD5

50108979364c7b97c1e105ec0a779550
SHA1

670964fceb2fed736e6c421e32d49046185a2908
SHA256

8e5773268a41238cf4c2f0954e14ab305b490f305b7d9aa696ae11278bb9bb92
SHA512

603032da9a5b79f22e6568fc5c879d4b8634a68cb03303532fed99d0ca41098d0d4f4d37beb69842d5f129a4666abc0a927050490ab6694e183e2e3046e9b55f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1140	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1140	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1140	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1140	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1140	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1140	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1140	1924	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\8e5773268a41238cf4c2f0954e14ab305b490f305b7d9aa696ae11278bb9bb92.bin =^_^=.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\8e5773268a41238cf4c2f0954e14ab305b490f305b7d9aa696ae11278bb9bb92.bin =^_^=.dll"
2⤵
PID:1140

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-61-0x0000000000000000-mapping.dmp

Download
memory/1140-62-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1924-60-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Filesize
8KB

Download