c5dea477d2e029d1d2debe478a1d60533d49a88652f7ffe7e7ea3fa0983b4dbe

General
Target

c5dea477d2e029d1d2debe478a1d60533d49a88652f7ffe7e7ea3fa0983b4dbe.dll

Filesize

574KB

Completed

15-01-2022 01:19

Score
1/10
MD5

5210374af655542588f7317f80f7d5da

SHA1

8f262a120075b22ca01ba883d47fcabb7558a6bc

SHA256

c5dea477d2e029d1d2debe478a1d60533d49a88652f7ffe7e7ea3fa0983b4dbe

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3544 wrote to memory of 37963544regsvr32.exeregsvr32.exe
    PID 3544 wrote to memory of 37963544regsvr32.exeregsvr32.exe
    PID 3544 wrote to memory of 37963544regsvr32.exeregsvr32.exe
    PID 3796 wrote to memory of 3003796regsvr32.exerundll32.exe
    PID 3796 wrote to memory of 3003796regsvr32.exerundll32.exe
    PID 3796 wrote to memory of 3003796regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c5dea477d2e029d1d2debe478a1d60533d49a88652f7ffe7e7ea3fa0983b4dbe.dll
    Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\c5dea477d2e029d1d2debe478a1d60533d49a88652f7ffe7e7ea3fa0983b4dbe.dll
      Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c5dea477d2e029d1d2debe478a1d60533d49a88652f7ffe7e7ea3fa0983b4dbe.dll",DllRegisterServer
        PID:300
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/300-118-0x0000000000000000-mapping.dmp

                            Download

                          • memory/3796-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/3796-116-0x0000000003251000-0x0000000003275000-memory.dmp

                            Download

                          • memory/3796-117-0x0000000003275000-0x0000000003276000-memory.dmp

                            Download