4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8 | Triage

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-en-20211104
submitted
13/11/2021, 17:35

Sharing

Report Analysis Logs

General

Target

4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8.dll
Size

71KB
MD5

2683fc47adb5eb8336372c054bb88c76
SHA1

ee33902011ba8cee84b7677c4238ec74299b05eb
SHA256

4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8
SHA512

90bebc6356306e1700ec1b41f9a3785cef6861ae250344c12369957db4a63e063848fd7b76d9e7ef0fb7f6db56237ce67448c752749851da78e132cc52898e73

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1076	996	regsvr32.exe	28
PID 996 wrote to memory of 1076	996	regsvr32.exe	28
PID 996 wrote to memory of 1076	996	regsvr32.exe	28
PID 996 wrote to memory of 1076	996	regsvr32.exe	28
PID 996 wrote to memory of 1076	996	regsvr32.exe	28
PID 996 wrote to memory of 1076	996	regsvr32.exe	28
PID 996 wrote to memory of 1076	996	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4705efa3b15c6affdd66a3aaa7393db6f87661dc341606231867efae8478f4b8.dll
  2⤵
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-55-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/1076-57-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download