2c39e7cbc86c0b1558070d81c7b8e543f94a562bd7bc699ddcc20b4286c32c73 | Triage™

Analysis

max time kernel
119s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
13/01/2022, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74gF3LRBT.dll
Size 1.4MB
Sample220113-vmgkcabfg6
SHA256 2c39e7cbc86c0b1558070d81c7b8e543f94a562bd7bc699ddcc20b4286c32c73
MD5 de6d88557ad5cdfcee5f19c12da8cce2
SHA1 282f52e36d8eeb528329c241f4a52418b50cb1d7
SHA512 a74d0d3b1b412a0aa64a2046c478d7acbd5d693c772ca3f5b4caa842f05eef5f69301f162c0da4580a93608e70e656923ca1b9d317b7d692ffc3933d4c2bab36
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2500	2336	regsvr32.exe	68
PID 2336 wrote to memory of 2500	2336	regsvr32.exe	68
PID 2336 wrote to memory of 2500	2336	regsvr32.exe	68
PID 2500 wrote to memory of 3032	2500	regsvr32.exe	69
PID 2500 wrote to memory of 3032	2500	regsvr32.exe	69
PID 2500 wrote to memory of 3032	2500	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74gF3LRBT.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74gF3LRBT.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\74gF3LRBT.dll",DllRegisterServer
    3⤵
    PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2500-117-0x0000000004A80000-0x0000000004AA8000-memory.dmp

Download