f514a6cd9bc1c4e8e450b468f543763062b321111ca26d6fe0f3f236a0a93742

General
Target

f514a6cd9bc1c4e8e450b468f543763062b321111ca26d6fe0f3f236a0a93742.dll

Filesize

574KB

Completed

15-01-2022 01:47

Score
1/10
MD5

b55bd7d7833da0e8284b0794e1858c66

SHA1

f65890c4555db363b0b51de9405df2d8ad8d6df8

SHA256

f514a6cd9bc1c4e8e450b468f543763062b321111ca26d6fe0f3f236a0a93742

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2708 wrote to memory of 27442708regsvr32.exeregsvr32.exe
    PID 2708 wrote to memory of 27442708regsvr32.exeregsvr32.exe
    PID 2708 wrote to memory of 27442708regsvr32.exeregsvr32.exe
    PID 2744 wrote to memory of 36642744regsvr32.exerundll32.exe
    PID 2744 wrote to memory of 36642744regsvr32.exerundll32.exe
    PID 2744 wrote to memory of 36642744regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f514a6cd9bc1c4e8e450b468f543763062b321111ca26d6fe0f3f236a0a93742.dll
    Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f514a6cd9bc1c4e8e450b468f543763062b321111ca26d6fe0f3f236a0a93742.dll
      Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f514a6cd9bc1c4e8e450b468f543763062b321111ca26d6fe0f3f236a0a93742.dll",DllRegisterServer
        PID:3664
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/2744-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/2744-117-0x0000000000C85000-0x0000000000C86000-memory.dmp

                            Download

                          • memory/2744-116-0x0000000000C61000-0x0000000000C85000-memory.dmp

                            Download

                          • memory/3664-118-0x0000000000000000-mapping.dmp

                            Download