4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38

General
Target

4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll

Filesize

574KB

Completed

15-01-2022 01:44

Score
1/10
MD5

e6a764852dc8e94d3c07889f0bda6687

SHA1

b2383f99ba3c5f4447b6cc0e5e031d45c6660ee0

SHA256

4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1908 wrote to memory of 37321908regsvr32.exeregsvr32.exe
    PID 1908 wrote to memory of 37321908regsvr32.exeregsvr32.exe
    PID 1908 wrote to memory of 37321908regsvr32.exeregsvr32.exe
    PID 3732 wrote to memory of 40363732regsvr32.exerundll32.exe
    PID 3732 wrote to memory of 40363732regsvr32.exerundll32.exe
    PID 3732 wrote to memory of 40363732regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll
    Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll
      Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll",DllRegisterServer
        PID:4036
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3732-115-0x0000000000000000-mapping.dmp

                          • memory/3732-117-0x00000000048D5000-0x00000000048D6000-memory.dmp

                          • memory/3732-116-0x00000000048B1000-0x00000000048D5000-memory.dmp

                          • memory/4036-118-0x0000000000000000-mapping.dmp