25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0

General
Target

25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll

Filesize

574KB

Completed

15-01-2022 01:11

Score
1/10
MD5

08cf6ea72d80dbb3f2ce9ba4a2b27aa4

SHA1

9ea2a40ae2814c22704945e1db6cc3c812fa11a1

SHA256

25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2612 wrote to memory of 26762612regsvr32.exeregsvr32.exe
    PID 2612 wrote to memory of 26762612regsvr32.exeregsvr32.exe
    PID 2612 wrote to memory of 26762612regsvr32.exeregsvr32.exe
    PID 2676 wrote to memory of 26922676regsvr32.exerundll32.exe
    PID 2676 wrote to memory of 26922676regsvr32.exerundll32.exe
    PID 2676 wrote to memory of 26922676regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll
    Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll
      Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll",DllRegisterServer
        PID:2692
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/2676-118-0x0000000000000000-mapping.dmp

                            Download

                          • memory/2676-120-0x0000000000DF5000-0x0000000000DF6000-memory.dmp

                            Download

                          • memory/2676-119-0x0000000000DD1000-0x0000000000DF5000-memory.dmp

                            Download

                          • memory/2692-121-0x0000000000000000-mapping.dmp

                            Download