1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686

General
Target

1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll

Filesize

574KB

Completed

15-01-2022 01:28

Score
1/10
MD5

e1310ecd0e017d26fc29dc99a973fa07

SHA1

ff4c1b0eafca4e7cc8c70079d39fded035620640

SHA256

1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2588 wrote to memory of 25842588regsvr32.exeregsvr32.exe
    PID 2588 wrote to memory of 25842588regsvr32.exeregsvr32.exe
    PID 2588 wrote to memory of 25842588regsvr32.exeregsvr32.exe
    PID 2584 wrote to memory of 10202584regsvr32.exerundll32.exe
    PID 2584 wrote to memory of 10202584regsvr32.exerundll32.exe
    PID 2584 wrote to memory of 10202584regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll
    Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll
      Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll",DllRegisterServer
        PID:1020
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1020-118-0x0000000000000000-mapping.dmp

                          • memory/2584-115-0x0000000000000000-mapping.dmp

                          • memory/2584-117-0x00000000033C5000-0x00000000033C6000-memory.dmp