959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e | Triage

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-en-20211104
submitted
13-11-2021 17:36

Sharing

Report Analysis Logs

General

Target

959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e.dll
Size

63KB
MD5

1b4424fceeabdb973c42c023ec8a8ea2
SHA1

5b669bc3867d0b407181c0920fa8eaf36a986234
SHA256

959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e
SHA512

0d859c89db7341fdd20c50422f0c2c0f58913b620a2d246893a1b3c77f19c0e330352b374be96db8a3899bf1df462632e6e8470a0f5bfde986417ca71d61c12d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 780	452	regsvr32.exe	28
PID 452 wrote to memory of 780	452	regsvr32.exe	28
PID 452 wrote to memory of 780	452	regsvr32.exe	28
PID 452 wrote to memory of 780	452	regsvr32.exe	28
PID 452 wrote to memory of 780	452	regsvr32.exe	28
PID 452 wrote to memory of 780	452	regsvr32.exe	28
PID 452 wrote to memory of 780	452	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e.dll
  2⤵
  PID:780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-55-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/780-57-0x0000000075461000-0x0000000075463000-memory.dmp

Filesize
8KB

Download