f745ae59b8e4c4c5d5d0872b86168bc8c82fef459bd2303993ac166cbe79acf9 | Triage

Analysis

max time kernel
145s
max time network
129s
platform
windows7_x64
resource
win7-en-20210920
submitted
02-10-2021 20:44

Sharing

Report Analysis Logs

General

Target

10000000.bcdf.dll
Size

50KB
MD5

4d4be2544b2e0a61beac5371a7695e04
SHA1

fabc2d4e221280b53a57814beb8b44d73855d4d6
SHA256

f745ae59b8e4c4c5d5d0872b86168bc8c82fef459bd2303993ac166cbe79acf9
SHA512

bcd9094363ea96d50530609a14cbeebd6db6e3ff285fd2556a6a11d7645244bb8da15848803a666931dde48cf93a94a238c1d16b778fccd6255bd6c5f20d83a3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 852	1216	regsvr32.exe	27
PID 1216 wrote to memory of 852	1216	regsvr32.exe	27
PID 1216 wrote to memory of 852	1216	regsvr32.exe	27
PID 1216 wrote to memory of 852	1216	regsvr32.exe	27
PID 1216 wrote to memory of 852	1216	regsvr32.exe	27
PID 1216 wrote to memory of 852	1216	regsvr32.exe	27
PID 1216 wrote to memory of 852	1216	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\10000000.bcdf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\10000000.bcdf.dll
  2⤵
  PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1216-53-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download