Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    15-01-2022 01:16

General

  • Target

    ce29ed19a8387e9512f91202502fa581077541d079c33633e7412269d49a1149.dll

  • Size

    574KB

  • MD5

    dcbcfcd0599ce404ccaa3feb19db6a84

  • SHA1

    e791826eaa417db349267a91613876dbcf1a10aa

  • SHA256

    ce29ed19a8387e9512f91202502fa581077541d079c33633e7412269d49a1149

  • SHA512

    e78d78a70e0decbf678e886aa1067c7a96f1c5d7cda5b67d03c269e8ef6ec7b40b33d5931c23bd7022147859414b7768d25619c2a239fe5ec3d3edb531c88d2f

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ce29ed19a8387e9512f91202502fa581077541d079c33633e7412269d49a1149.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\ce29ed19a8387e9512f91202502fa581077541d079c33633e7412269d49a1149.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ce29ed19a8387e9512f91202502fa581077541d079c33633e7412269d49a1149.dll",DllRegisterServer
        3⤵
          PID:2760

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2504-115-0x0000000000000000-mapping.dmp
    • memory/2504-116-0x0000000003021000-0x0000000003045000-memory.dmp
      Filesize

      144KB

    • memory/2504-117-0x0000000003045000-0x0000000003046000-memory.dmp
      Filesize

      4KB

    • memory/2760-118-0x0000000000000000-mapping.dmp