3520878d12fec8f7551b20ad31d067d9ea3be19c7cd48232213662f24eff994f

General
Target

3520878d12fec8f7551b20ad31d067d9ea3be19c7cd48232213662f24eff994f.dll

Filesize

574KB

Completed

15-01-2022 01:47

Score
1/10
MD5

91fca0bee57f8e0b963df4b6bfe5587c

SHA1

ae046e3a69f965a217eb63b609dd55e33a4f23c6

SHA256

3520878d12fec8f7551b20ad31d067d9ea3be19c7cd48232213662f24eff994f

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2532 wrote to memory of 27362532regsvr32.exeregsvr32.exe
    PID 2532 wrote to memory of 27362532regsvr32.exeregsvr32.exe
    PID 2532 wrote to memory of 27362532regsvr32.exeregsvr32.exe
    PID 2736 wrote to memory of 30322736regsvr32.exerundll32.exe
    PID 2736 wrote to memory of 30322736regsvr32.exerundll32.exe
    PID 2736 wrote to memory of 30322736regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3520878d12fec8f7551b20ad31d067d9ea3be19c7cd48232213662f24eff994f.dll
    Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\3520878d12fec8f7551b20ad31d067d9ea3be19c7cd48232213662f24eff994f.dll
      Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3520878d12fec8f7551b20ad31d067d9ea3be19c7cd48232213662f24eff994f.dll",DllRegisterServer
        PID:3032
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/2736-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/2736-116-0x0000000003F91000-0x0000000003FB5000-memory.dmp

                            Download

                          • memory/2736-117-0x0000000003FB5000-0x0000000003FB6000-memory.dmp

                            Download

                          • memory/3032-118-0x0000000000000000-mapping.dmp

                            Download