fd8237417d71c5c0d390bf8e5cfd4019843310c01262a90cb6de53dbc4d25312 | Triage™

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211104
submitted
03/12/2021, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Fragtor.43252.2522.24833.dll
Size 449KB
Sample211203-e3n2cshed6
SHA256 fd8237417d71c5c0d390bf8e5cfd4019843310c01262a90cb6de53dbc4d25312
MD5 c22d8cdca3bf5286ed08414720218187
SHA1 eda18e76bcc1b06bed4a9e7bb5b86f1d749dff40
SHA512 10d097eb59e822ac67fccde95e95a9b5b77b727e4693ad3ee5a8b04aa46839cffec96e1e31ccaa3324749f9ebae4fcb6de6639014ba8d7bd6f9214d84372bc40
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1032	472	regsvr32.exe	28
PID 472 wrote to memory of 1032	472	regsvr32.exe	28
PID 472 wrote to memory of 1032	472	regsvr32.exe	28
PID 472 wrote to memory of 1032	472	regsvr32.exe	28
PID 472 wrote to memory of 1032	472	regsvr32.exe	28
PID 472 wrote to memory of 1032	472	regsvr32.exe	28
PID 472 wrote to memory of 1032	472	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Fragtor.43252.2522.24833.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Fragtor.43252.2522.24833.dll
  2⤵
  PID:1032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-55-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Download

memory/1032-57-0x0000000075731000-0x0000000075733000-memory.dmp

Download