24ddbfd580892c7c8296443b2984d8b8a75ace197a7ad73a8b9ada6bf36dcf7d | Triage™

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
12/01/2022, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jg3IeIbuQ3.dll
Size 470KB
Sample220112-mstsvscdbp
SHA256 24ddbfd580892c7c8296443b2984d8b8a75ace197a7ad73a8b9ada6bf36dcf7d
MD5 ca11d65999837dbdf40585054063e265
SHA1 59ddfbf27ba64f4a7566ec0a96e4574557eb6a28
SHA512 6bd4f91259ac1afa4e8939bcbe4769d8d60c4164917cf8eaaa914dc3fd6a1fee29d8a768579725f01cbcce21780a4ad4a829a8da49cae35cd94da7ea2a2a3b9e
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 3308	3240	regsvr32.exe	69
PID 3240 wrote to memory of 3308	3240	regsvr32.exe	69
PID 3240 wrote to memory of 3308	3240	regsvr32.exe	69
PID 3308 wrote to memory of 8	3308	regsvr32.exe	70
PID 3308 wrote to memory of 8	3308	regsvr32.exe	70
PID 3308 wrote to memory of 8	3308	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Jg3IeIbuQ3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Jg3IeIbuQ3.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Jg3IeIbuQ3.dll",DllRegisterServer
    3⤵
    PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3308-117-0x0000000002C00000-0x0000000002D4A000-memory.dmp

Download