91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7v20210410
submitted
30-07-2021 09:06

Sharing

Report Analysis Logs

General

Target

iSignatureHTMLAddin.ocx.dll
Size

1.2MB
MD5

28b4fd6497bbc422a9c9d214aa1e6a8a
SHA1

0e5be0d1530d3b27a2664ccfc52e02c462903ccb
SHA256

949593c8971f660e2783d1e2a533579ab8767416bfc109b3ebf9885ea65807b4
SHA512

afe69ac3f61fbeeb08f9e715b8be8486fdd78634ebc41f3a6ddf07e40b594a2fb18a5ca6786fb5db990e7d7cdb0a6b2b83a39407f78bbc60c545b016cb8c206b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1688 wrote to memory of 1488	1688	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 1488	1688	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 1488	1688	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 1488	1688	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 1488	1688	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 1488	1688	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 1488	1688	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\iSignatureHTMLAddin.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\iSignatureHTMLAddin.ocx.dll
2⤵
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-61-0x0000000000000000-mapping.dmp

Download
memory/1488-62-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1488-63-0x0000000001F40000-0x0000000002081000-memory.dmp

Filesize
1.3MB

Download
memory/1688-60-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download