93bdd726a35fe367f144c8b175ae5a073438e533981e0c2c7753bd8bb5acac75

General
Target

93bdd726a35fe367f144c8b175ae5a073438e533981e0c2c7753bd8bb5acac75.dll

Filesize

574KB

Completed

15-01-2022 01:44

Score
1/10
MD5

9de617ef9e292fc16d7425d79ff11dbf

SHA1

2d7bde721a70ed3c81af60979a3bf1fc414321b3

SHA256

93bdd726a35fe367f144c8b175ae5a073438e533981e0c2c7753bd8bb5acac75

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2764 wrote to memory of 28002764regsvr32.exeregsvr32.exe
    PID 2764 wrote to memory of 28002764regsvr32.exeregsvr32.exe
    PID 2764 wrote to memory of 28002764regsvr32.exeregsvr32.exe
    PID 2800 wrote to memory of 21842800regsvr32.exerundll32.exe
    PID 2800 wrote to memory of 21842800regsvr32.exerundll32.exe
    PID 2800 wrote to memory of 21842800regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\93bdd726a35fe367f144c8b175ae5a073438e533981e0c2c7753bd8bb5acac75.dll
    Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\93bdd726a35fe367f144c8b175ae5a073438e533981e0c2c7753bd8bb5acac75.dll
      Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\93bdd726a35fe367f144c8b175ae5a073438e533981e0c2c7753bd8bb5acac75.dll",DllRegisterServer
        PID:2184
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/2184-118-0x0000000000000000-mapping.dmp

                            Download

                          • memory/2800-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/2800-116-0x0000000000AE1000-0x0000000000B05000-memory.dmp

                            Download

                          • memory/2800-117-0x0000000000B05000-0x0000000000B06000-memory.dmp

                            Download