91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9 | Triage

Analysis

max time kernel
12s
max time network
124s
platform
windows10_x64
resource
win10v20210408
submitted
30-07-2021 09:06

Sharing

Report Analysis Logs

General

Target

iSignatureHTMLAddin.ocx.dll
Size

1.2MB
MD5

28b4fd6497bbc422a9c9d214aa1e6a8a
SHA1

0e5be0d1530d3b27a2664ccfc52e02c462903ccb
SHA256

949593c8971f660e2783d1e2a533579ab8767416bfc109b3ebf9885ea65807b4
SHA512

afe69ac3f61fbeeb08f9e715b8be8486fdd78634ebc41f3a6ddf07e40b594a2fb18a5ca6786fb5db990e7d7cdb0a6b2b83a39407f78bbc60c545b016cb8c206b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 636 wrote to memory of 3976	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 3976	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 3976	636	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\iSignatureHTMLAddin.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\iSignatureHTMLAddin.ocx.dll
2⤵
PID:3976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-114-0x0000000000000000-mapping.dmp

Download