37cbb8074087f0640a259eab3e591cde1dc360d2288a6d9fbb92a5fb3c1b68ba | Triage™

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7v20210410
submitted
22/06/2021, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90aeb9022df2a96c7084513cdd72075a.dll
Size 277KB
Sample210622-e286jzbr46
SHA256 37cbb8074087f0640a259eab3e591cde1dc360d2288a6d9fbb92a5fb3c1b68ba
MD5 90aeb9022df2a96c7084513cdd72075a
SHA1 b0e962482c27beda13e87a7cb00b26b7ca7e2559
SHA512 c185ba6e2129cb91b063793cf78159d47e930df07838c1cf2a0095ca89ef0ad9021144cfd001c14ae2713bc7099a8db8c5500087bd2ab151e8f1a99ea5c5006b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1064	1088	regsvr32.exe	26
PID 1088 wrote to memory of 1064	1088	regsvr32.exe	26
PID 1088 wrote to memory of 1064	1088	regsvr32.exe	26
PID 1088 wrote to memory of 1064	1088	regsvr32.exe	26
PID 1088 wrote to memory of 1064	1088	regsvr32.exe	26
PID 1088 wrote to memory of 1064	1088	regsvr32.exe	26
PID 1088 wrote to memory of 1064	1088	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\90aeb9022df2a96c7084513cdd72075a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\90aeb9022df2a96c7084513cdd72075a.dll
  2⤵
  PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-62-0x00000000753B1000-0x00000000753B3000-memory.dmp

Download

memory/1088-60-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp

Download