0d3716620264ae87b753d9b89f37b9b44f54a90b5df6dc93a8af9c7d1c23b87d | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
13-12-2021 07:14

Sharing

Report Analysis Logs

General

Target

tmp/0d3716620264ae87b753d9b89f37b9b44f54a90b5df6dc93a8af9c7d1c23b87d.exe.dll
Size

56KB
MD5

ef9b294be6e74fe143e7931ace3b5771
SHA1

1b8a2df55437454739f5a2c0a6f027db94b3ab1a
SHA256

0d3716620264ae87b753d9b89f37b9b44f54a90b5df6dc93a8af9c7d1c23b87d
SHA512

0d71afe65df3ff1ff208b98aaf6dcdfca6e525662ac21f5920367415176c5a993e65eed022047d0c4b4af4fcd923f4fd517e9aac96659fbf701c2c0ed062618e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 480 wrote to memory of 1656	480	regsvr32.exe	regsvr32.exe
PID 480 wrote to memory of 1656	480	regsvr32.exe	regsvr32.exe
PID 480 wrote to memory of 1656	480	regsvr32.exe	regsvr32.exe
PID 480 wrote to memory of 1656	480	regsvr32.exe	regsvr32.exe
PID 480 wrote to memory of 1656	480	regsvr32.exe	regsvr32.exe
PID 480 wrote to memory of 1656	480	regsvr32.exe	regsvr32.exe
PID 480 wrote to memory of 1656	480	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmp\0d3716620264ae87b753d9b89f37b9b44f54a90b5df6dc93a8af9c7d1c23b87d.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:480

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\tmp\0d3716620264ae87b753d9b89f37b9b44f54a90b5df6dc93a8af9c7d1c23b87d.exe.dll
2⤵
PID:1656

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-55-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/1656-56-0x0000000000000000-mapping.dmp

Download
memory/1656-57-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download