ebab3a18bf406017dc2dec6f813b7cf7608b52d64365fd4d109149fb4a5801b0 | Triage™

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-en-20211014
submitted
07/12/2021, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6f3494064e025c03826c7c9a41affa1.dll
Size 215KB
Sample211207-ve5bfabeek
SHA256 ebab3a18bf406017dc2dec6f813b7cf7608b52d64365fd4d109149fb4a5801b0
MD5 c6f3494064e025c03826c7c9a41affa1
SHA1 e46adfff34ef125c7bec7c32b6c1c982c93764ca
SHA512 088391062bcfe0fa8a13615dc221fb6522a0ac7d67574955c294b345a55480a7be294e48dd19287e4bf2e9af065e24ec38546041895f6b97d2578ff13797a2fe
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2024	1880	regsvr32.exe	27
PID 1880 wrote to memory of 2024	1880	regsvr32.exe	27
PID 1880 wrote to memory of 2024	1880	regsvr32.exe	27
PID 1880 wrote to memory of 2024	1880	regsvr32.exe	27
PID 1880 wrote to memory of 2024	1880	regsvr32.exe	27
PID 1880 wrote to memory of 2024	1880	regsvr32.exe	27
PID 1880 wrote to memory of 2024	1880	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6f3494064e025c03826c7c9a41affa1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c6f3494064e025c03826c7c9a41affa1.dll
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-55-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Download

memory/2024-57-0x0000000075D41000-0x0000000075D43000-memory.dmp

Download