e180a872a0dc889066d57d0f53898aa731762d2a85573ae6f99007b0564788d2 | Triage

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-en-20211104
submitted
13-11-2021 17:36

Sharing

Report Analysis Logs

General

Target

e180a872a0dc889066d57d0f53898aa731762d2a85573ae6f99007b0564788d2.dll
Size

52KB
MD5

0cd17ed77e0caeaa3ec3a96de3959eb9
SHA1

7b03599c4353b2abd1928c9e527a2d6b36b8c39c
SHA256

e180a872a0dc889066d57d0f53898aa731762d2a85573ae6f99007b0564788d2
SHA512

c5dec538c95962bbb5b8259be99d09015ab95ea93ef948ad586264978257a2082a5e92fa7e37756d9164caef2f3549d2edd95cf22438e279fad3796f67f67dcb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1208	472	regsvr32.exe	28
PID 472 wrote to memory of 1208	472	regsvr32.exe	28
PID 472 wrote to memory of 1208	472	regsvr32.exe	28
PID 472 wrote to memory of 1208	472	regsvr32.exe	28
PID 472 wrote to memory of 1208	472	regsvr32.exe	28
PID 472 wrote to memory of 1208	472	regsvr32.exe	28
PID 472 wrote to memory of 1208	472	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e180a872a0dc889066d57d0f53898aa731762d2a85573ae6f99007b0564788d2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e180a872a0dc889066d57d0f53898aa731762d2a85573ae6f99007b0564788d2.dll
  2⤵
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-55-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/1208-57-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download