dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922 | Triage

Resubmissions

18-01-2022 01:59

220118-ceefxafch7 1

18-01-2022 01:25

220118-bszhkafad6 10

12-01-2022 19:02

220112-xptnssdgap 1

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-en-20211208
submitted
12-01-2022 19:02

Sharing

Report Analysis Logs

General

Target

r5t3fovxD.dll
Size

470KB
MD5

3eed9d1f62e0ae2678a708e9aaea2e83
SHA1

a30470351ad507f1bf12d11e7c6008f2e821cd98
SHA256

da9365e086fb31ed7d832365cf96ffd2697d47f12deb8bf34bd5b1a50870299e
SHA512

334a23dca68b451c213c74ff0b8363dafd6de8ac0807999b11c60b00e889f19312629ad842d1a0f3f2c7a65465522905155303055a7ab18709b8d9a4ac781551

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 964 wrote to memory of 1720	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1720	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1720	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1720	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1720	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1720	964	regsvr32.exe	regsvr32.exe
PID 964 wrote to memory of 1720	964	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	rundll32.exe
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	rundll32.exe
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	rundll32.exe
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	rundll32.exe
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	rundll32.exe
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	rundll32.exe
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\r5t3fovxD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\r5t3fovxD.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\r5t3fovxD.dll",DllRegisterServer
3⤵
PID:1796

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-53-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Filesize
8KB

Download
memory/1720-54-0x0000000000000000-mapping.dmp

Download
memory/1720-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1720-58-0x00000000001C0000-0x00000000001E9000-memory.dmp

Filesize
164KB

Download
memory/1796-56-0x0000000000000000-mapping.dmp

Download