50860da06147ec56df91d2f10fd66d9d0d462d544bd4e4b5e805f4c3308ed132 | Triage™

Analysis

max time kernel
123s
max time network
150s
platform
windows10_x64
resource
win10-en-20211208
submitted
13/01/2022, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ygqtFS.dll
Size 736KB
Sample220113-rt9ypaahfm
SHA256 50860da06147ec56df91d2f10fd66d9d0d462d544bd4e4b5e805f4c3308ed132
MD5 1ad3a1d95f68f10a29e585f2f1ae02c5
SHA1 14faff48b7998a723bb13204fe0ed332429e7eac
SHA512 52072d73515c99ecc81b225762e083e2c60dd6a4be289552c68a84b854eb62279603ef12b6da8b6eb54aac1b198996647d8342f6808d92952299845ebf786d01
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2740	2732	regsvr32.exe	69
PID 2732 wrote to memory of 2740	2732	regsvr32.exe	69
PID 2732 wrote to memory of 2740	2732	regsvr32.exe	69
PID 2740 wrote to memory of 3784	2740	regsvr32.exe	70
PID 2740 wrote to memory of 3784	2740	regsvr32.exe	70
PID 2740 wrote to memory of 3784	2740	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ygqtFS.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ygqtFS.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ygqtFS.dll",DllRegisterServer
    3⤵
    PID:3784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-117-0x0000000004BA5000-0x0000000004BA6000-memory.dmp

Download

memory/2740-116-0x0000000004B81000-0x0000000004BA5000-memory.dmp

Download