aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-en-20211104
submitted
13-11-2021 17:36

Sharing

Report Analysis Logs

General

Target

aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935.dll
Size

64KB
MD5

be8d59bd1e83b5f5593fd5c3fb62b0fa
SHA1

4a056486aa431e9f1645d9d4c59913278249e8dd
SHA256

aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935
SHA512

c697a9353d1187f850779d9d0a1d2da4d7f85d5aed908681aaa1f81beb025cfffe92bf76204a8755e5f15d2ab92496e214afcb34e10de050f993281f6dc3aa24

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 776	320	regsvr32.exe	28
PID 320 wrote to memory of 776	320	regsvr32.exe	28
PID 320 wrote to memory of 776	320	regsvr32.exe	28
PID 320 wrote to memory of 776	320	regsvr32.exe	28
PID 320 wrote to memory of 776	320	regsvr32.exe	28
PID 320 wrote to memory of 776	320	regsvr32.exe	28
PID 320 wrote to memory of 776	320	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935.dll
  2⤵
  PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-55-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download
memory/776-57-0x00000000751C1000-0x00000000751C3000-memory.dmp

Filesize
8KB

Download