636af8df31c8919739cfe1dfc89b412a2a50b1d19e5becf2f5cd280f7db859ae | Triage

Analysis

max time kernel
151s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
27-12-2021 09:14

Sharing

Report Analysis Logs

General

Target

tmp/636af8df31c8919739cfe1dfc89b412a2a50b1d19e5becf2f5cd280f7db859ae.exe.dll
Size

117KB
MD5

847efc3ae1f6445587d06579c2ac0b04
SHA1

0788bcf1d47c45531d709282cd4bb362a227f4be
SHA256

636af8df31c8919739cfe1dfc89b412a2a50b1d19e5becf2f5cd280f7db859ae
SHA512

159fea62f5c8bd75737b21f1c05eb802c1c9294f06cf195778d60b4c6a10ec4e9a418b00c1f6ba71052e850b5baaf0783e837f35177e8f34076dc5fe0c3e8c6f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3048 wrote to memory of 2780	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2780	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2780	3048	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmp\636af8df31c8919739cfe1dfc89b412a2a50b1d19e5becf2f5cd280f7db859ae.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\tmp\636af8df31c8919739cfe1dfc89b412a2a50b1d19e5becf2f5cd280f7db859ae.exe.dll
2⤵
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-115-0x0000000000000000-mapping.dmp

Download
memory/2780-117-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/2780-116-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/2780-118-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download