b0441bc63773e1719aac9acbd99f6e72bdd31017038e5e26af2646bef8c974f3 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211104
submitted
13-11-2021 17:36

Sharing

Report Analysis Logs

General

Target

b0441bc63773e1719aac9acbd99f6e72bdd31017038e5e26af2646bef8c974f3.dll
Size

58KB
MD5

e58e26b525a717c0f140fd3c56b768ad
SHA1

b8222a45ce2f24d098f0de9745a8852c66879888
SHA256

b0441bc63773e1719aac9acbd99f6e72bdd31017038e5e26af2646bef8c974f3
SHA512

98ba5b908ae378a580d1e4019258a7d512aa805016e33de79581884c2f9340059d68a6b5475a326f5734b665931215e5dbc69ce5a8f81bfd47c6268e74495857

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 320	524	regsvr32.exe	28
PID 524 wrote to memory of 320	524	regsvr32.exe	28
PID 524 wrote to memory of 320	524	regsvr32.exe	28
PID 524 wrote to memory of 320	524	regsvr32.exe	28
PID 524 wrote to memory of 320	524	regsvr32.exe	28
PID 524 wrote to memory of 320	524	regsvr32.exe	28
PID 524 wrote to memory of 320	524	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b0441bc63773e1719aac9acbd99f6e72bdd31017038e5e26af2646bef8c974f3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b0441bc63773e1719aac9acbd99f6e72bdd31017038e5e26af2646bef8c974f3.dll
  2⤵
  PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-57-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/524-55-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

Filesize
8KB

Download