f01b08185494291739a4962b94e18ee32695bb2cf34d23a8d8ac6bd03eb5dbe1

General
Target

f01b08185494291739a4962b94e18ee32695bb2cf34d23a8d8ac6bd03eb5dbe1.dll

Filesize

574KB

Completed

15-01-2022 01:23

Score
1/10
MD5

f9b2203dd6c6a463b62141422af2bbdf

SHA1

0718ed08ce31777e4535435743c7f49f867556da

SHA256

f01b08185494291739a4962b94e18ee32695bb2cf34d23a8d8ac6bd03eb5dbe1

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3668 wrote to memory of 37243668regsvr32.exeregsvr32.exe
    PID 3668 wrote to memory of 37243668regsvr32.exeregsvr32.exe
    PID 3668 wrote to memory of 37243668regsvr32.exeregsvr32.exe
    PID 3724 wrote to memory of 41003724regsvr32.exerundll32.exe
    PID 3724 wrote to memory of 41003724regsvr32.exerundll32.exe
    PID 3724 wrote to memory of 41003724regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f01b08185494291739a4962b94e18ee32695bb2cf34d23a8d8ac6bd03eb5dbe1.dll
    Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f01b08185494291739a4962b94e18ee32695bb2cf34d23a8d8ac6bd03eb5dbe1.dll
      Suspicious use of WriteProcessMemory
      PID:3724
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f01b08185494291739a4962b94e18ee32695bb2cf34d23a8d8ac6bd03eb5dbe1.dll",DllRegisterServer
        PID:4100
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3724-118-0x0000000000000000-mapping.dmp

                          • memory/3724-119-0x0000000000961000-0x0000000000985000-memory.dmp

                          • memory/3724-120-0x0000000000985000-0x0000000000986000-memory.dmp

                          • memory/4100-121-0x0000000000000000-mapping.dmp