959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e | Triage

Analysis

max time kernel
166s
max time network
163s
platform
windows10_x64
resource
win10-en-20211014
submitted
13-11-2021 17:36

Sharing

Report Analysis Logs

General

Target

959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e.dll
Size

63KB
MD5

1b4424fceeabdb973c42c023ec8a8ea2
SHA1

5b669bc3867d0b407181c0920fa8eaf36a986234
SHA256

959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e
SHA512

0d859c89db7341fdd20c50422f0c2c0f58913b620a2d246893a1b3c77f19c0e330352b374be96db8a3899bf1df462632e6e8470a0f5bfde986417ca71d61c12d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 1300	3096	regsvr32.exe	68
PID 3096 wrote to memory of 1300	3096	regsvr32.exe	68
PID 3096 wrote to memory of 1300	3096	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\959c7cdcef7a5cc046e68943871701b50f76ce683949fdd5b2c373212e8c7f8e.dll
  2⤵
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads