5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86

General
Target

5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll

Filesize

574KB

Completed

15-01-2022 01:47

Score
1/10
MD5

dab114e46255fe871f570cbf62ba8db5

SHA1

cf36ae8d18749eb72772d6537fb90d458f551270

SHA256

5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3732 wrote to memory of 33203732regsvr32.exeregsvr32.exe
    PID 3732 wrote to memory of 33203732regsvr32.exeregsvr32.exe
    PID 3732 wrote to memory of 33203732regsvr32.exeregsvr32.exe
    PID 3320 wrote to memory of 35243320regsvr32.exerundll32.exe
    PID 3320 wrote to memory of 35243320regsvr32.exerundll32.exe
    PID 3320 wrote to memory of 35243320regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll
    Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll
      Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll",DllRegisterServer
        PID:3524
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/3320-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/3320-117-0x0000000001325000-0x0000000001326000-memory.dmp

                            Download

                          • memory/3320-116-0x0000000001301000-0x0000000001325000-memory.dmp

                            Download

                          • memory/3524-118-0x0000000000000000-mapping.dmp

                            Download