f5e32d8cb4e20067c81e07d381f081a4832c65c4e15467ab542be23e7c446b0c

General
Target

f5e32d8cb4e20067c81e07d381f081a4832c65c4e15467ab542be23e7c446b0c.dll

Filesize

574KB

Completed

15-01-2022 01:39

Score
1/10
MD5

3eafe95f4b66e1b5dbd79eff54c01a1f

SHA1

9e2ff812d0142db5b889bdc8a0a95e8cdd6839d0

SHA256

f5e32d8cb4e20067c81e07d381f081a4832c65c4e15467ab542be23e7c446b0c

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2608 wrote to memory of 26482608regsvr32.exeregsvr32.exe
    PID 2608 wrote to memory of 26482608regsvr32.exeregsvr32.exe
    PID 2608 wrote to memory of 26482608regsvr32.exeregsvr32.exe
    PID 2648 wrote to memory of 34442648regsvr32.exerundll32.exe
    PID 2648 wrote to memory of 34442648regsvr32.exerundll32.exe
    PID 2648 wrote to memory of 34442648regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f5e32d8cb4e20067c81e07d381f081a4832c65c4e15467ab542be23e7c446b0c.dll
    Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f5e32d8cb4e20067c81e07d381f081a4832c65c4e15467ab542be23e7c446b0c.dll
      Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f5e32d8cb4e20067c81e07d381f081a4832c65c4e15467ab542be23e7c446b0c.dll",DllRegisterServer
        PID:3444
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/2648-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/2648-116-0x0000000004F71000-0x0000000004F95000-memory.dmp

                            Download

                          • memory/2648-117-0x0000000004F95000-0x0000000004F96000-memory.dmp

                            Download

                          • memory/3444-118-0x0000000000000000-mapping.dmp

                            Download