9a4e88c5913ff668d6a0abfa2a002f8d997aa1c749b21f0394419b506bf47045 | Triage

Analysis

max time kernel
111s
max time network
129s
platform
windows10_x64
resource
win10-en-20211208
submitted
15-01-2022 01:37

Sharing

Report Analysis Logs

General

Target

9a4e88c5913ff668d6a0abfa2a002f8d997aa1c749b21f0394419b506bf47045.dll
Size

574KB
MD5

f4fe96f664ccdc9df399f9b17b5dcae0
SHA1

8d3489e25381e533f8186b4201c230cc5e802716
SHA256

9a4e88c5913ff668d6a0abfa2a002f8d997aa1c749b21f0394419b506bf47045
SHA512

1031b38f4bfca1dfac43b9a43953758006b493b811888badee4f366bcd1572208faae4b4c2fcea4cac5e7fe468c04ba1c5129e6836a6d34076b1265d4dcadfb0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2840 wrote to memory of 2940	2840	regsvr32.exe	regsvr32.exe
PID 2840 wrote to memory of 2940	2840	regsvr32.exe	regsvr32.exe
PID 2840 wrote to memory of 2940	2840	regsvr32.exe	regsvr32.exe
PID 2940 wrote to memory of 2764	2940	regsvr32.exe	rundll32.exe
PID 2940 wrote to memory of 2764	2940	regsvr32.exe	rundll32.exe
PID 2940 wrote to memory of 2764	2940	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a4e88c5913ff668d6a0abfa2a002f8d997aa1c749b21f0394419b506bf47045.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9a4e88c5913ff668d6a0abfa2a002f8d997aa1c749b21f0394419b506bf47045.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9a4e88c5913ff668d6a0abfa2a002f8d997aa1c749b21f0394419b506bf47045.dll",DllRegisterServer
3⤵
PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-118-0x0000000000000000-mapping.dmp

Download
memory/2940-115-0x0000000000000000-mapping.dmp

Download
memory/2940-117-0x0000000003055000-0x0000000003056000-memory.dmp

Filesize
4KB

Download
memory/2940-116-0x0000000003031000-0x0000000003055000-memory.dmp

Filesize
144KB

Download