d36820a2a6f957fe2cfefabef255a96e0a430e2fe9cbe25e1fcb006b24398a27 | Triage™

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-en-20211104
submitted
04/12/2021, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
517d29a67e8b4ee8d819eacc6d6ad915.dll
Size 449KB
Sample211204-eynvssadck
SHA256 d36820a2a6f957fe2cfefabef255a96e0a430e2fe9cbe25e1fcb006b24398a27
MD5 517d29a67e8b4ee8d819eacc6d6ad915
SHA1 4dc289f7130b122210a8a13a7c33b258ac3a6c84
SHA512 cc5a43c4c8f4325168416a219180675777c665ec970cde073fec8eef0e0e3245d0a7579fcce640e49c1dfd062b128cb7a484c3f9f91c97604ae68d23040650a6
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 564	1580	regsvr32.exe	28
PID 1580 wrote to memory of 564	1580	regsvr32.exe	28
PID 1580 wrote to memory of 564	1580	regsvr32.exe	28
PID 1580 wrote to memory of 564	1580	regsvr32.exe	28
PID 1580 wrote to memory of 564	1580	regsvr32.exe	28
PID 1580 wrote to memory of 564	1580	regsvr32.exe	28
PID 1580 wrote to memory of 564	1580	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\517d29a67e8b4ee8d819eacc6d6ad915.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\517d29a67e8b4ee8d819eacc6d6ad915.dll
  2⤵
  PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-57-0x0000000076A21000-0x0000000076A23000-memory.dmp

Download

memory/1580-55-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download