aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935 | Triage

Analysis

max time kernel
148s
max time network
163s
platform
windows10_x64
resource
win10-en-20211014
submitted
13-11-2021 17:36

Sharing

Report Analysis Logs

General

Target

aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935.dll
Size

64KB
MD5

be8d59bd1e83b5f5593fd5c3fb62b0fa
SHA1

4a056486aa431e9f1645d9d4c59913278249e8dd
SHA256

aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935
SHA512

c697a9353d1187f850779d9d0a1d2da4d7f85d5aed908681aaa1f81beb025cfffe92bf76204a8755e5f15d2ab92496e214afcb34e10de050f993281f6dc3aa24

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3500	2848	regsvr32.exe	68
PID 2848 wrote to memory of 3500	2848	regsvr32.exe	68
PID 2848 wrote to memory of 3500	2848	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aca485160e43138fabceca42cd680f9a0e3ec31e386a9c25df3cbb3a9b2a9935.dll
  2⤵
  PID:3500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads