565c9dc17d38788a2e63be0c19d5824e32fc57d7ab38f02df4ad28deb3a1dd2f | Triage

Analysis

max time kernel
121s
max time network
112s
platform
windows10_x64
resource
win10-en-20211208
submitted
15-01-2022 01:49

Sharing

Report Analysis Logs

General

Target

565c9dc17d38788a2e63be0c19d5824e32fc57d7ab38f02df4ad28deb3a1dd2f.dll
Size

574KB
MD5

5b788a766fe3412d222d948a5877f1d6
SHA1

d4db2eb43a2c9009513ae418b8661c39f8f15945
SHA256

565c9dc17d38788a2e63be0c19d5824e32fc57d7ab38f02df4ad28deb3a1dd2f
SHA512

07b1e4c558d8a891824a80b450de761d8bbbfa26a3fc79c8ca9ed709fe9afd653f0f0db3db66dfb44458f9295885be2bd5b84ba4cd85d508085d80ece1485072

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3504 wrote to memory of 3696	3504	regsvr32.exe	regsvr32.exe
PID 3504 wrote to memory of 3696	3504	regsvr32.exe	regsvr32.exe
PID 3504 wrote to memory of 3696	3504	regsvr32.exe	regsvr32.exe
PID 3696 wrote to memory of 956	3696	regsvr32.exe	rundll32.exe
PID 3696 wrote to memory of 956	3696	regsvr32.exe	rundll32.exe
PID 3696 wrote to memory of 956	3696	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\565c9dc17d38788a2e63be0c19d5824e32fc57d7ab38f02df4ad28deb3a1dd2f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\565c9dc17d38788a2e63be0c19d5824e32fc57d7ab38f02df4ad28deb3a1dd2f.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3696

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\565c9dc17d38788a2e63be0c19d5824e32fc57d7ab38f02df4ad28deb3a1dd2f.dll",DllRegisterServer
3⤵
PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-118-0x0000000000000000-mapping.dmp

Download
memory/3696-115-0x0000000000000000-mapping.dmp

Download
memory/3696-116-0x0000000004D11000-0x0000000004D35000-memory.dmp

Filesize
144KB

Download
memory/3696-117-0x0000000004D35000-0x0000000004D36000-memory.dmp

Filesize
4KB

Download