dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922 | Triage

Resubmissions

18-01-2022 01:59

220118-ceefxafch7 1

18-01-2022 01:25

220118-bszhkafad6 10

12-01-2022 19:02

220112-xptnssdgap 1

Analysis

max time kernel
121s
max time network
130s
platform
windows10_x64
resource
win10-en-20211208
submitted
12-01-2022 19:02

Sharing

Report Analysis Logs

General

Target

NTn5cqpa.dll
Size

470KB
MD5

e4b28480c44a175190085a79e50aa56c
SHA1

3e43969468de455940920664b28cc0c8139924b6
SHA256

c60f319790c8cf0b2f39046c789428771ed2bf8f4c108d9b6e9c9bf024efd3c2
SHA512

2dfaa66429f27de1a8b86e693f2776eae593b671d1ae385ed3389e7ff528b4582e6a6695474123febfc34749c9aa2308c2b90b5c43bd41cd1d88a5e0a4b12964

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1956 wrote to memory of 660	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 660	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 660	1956	regsvr32.exe	regsvr32.exe
PID 660 wrote to memory of 1000	660	regsvr32.exe	rundll32.exe
PID 660 wrote to memory of 1000	660	regsvr32.exe	rundll32.exe
PID 660 wrote to memory of 1000	660	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll",DllRegisterServer
3⤵
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-115-0x0000000000000000-mapping.dmp

Download
memory/660-117-0x0000000003300000-0x000000000344A000-memory.dmp

Filesize
1.3MB

Download
memory/1000-116-0x0000000000000000-mapping.dmp

Download