9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203

General
Target

9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll

Filesize

574KB

Completed

15-01-2022 01:28

Score
1/10
MD5

2c51ede92ceebd6403fbd45cc52ef403

SHA1

e88068e0ed4730e87533666f12bbbb13427fd182

SHA256

9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2632 wrote to memory of 30522632regsvr32.exeregsvr32.exe
    PID 2632 wrote to memory of 30522632regsvr32.exeregsvr32.exe
    PID 2632 wrote to memory of 30522632regsvr32.exeregsvr32.exe
    PID 3052 wrote to memory of 35803052regsvr32.exerundll32.exe
    PID 3052 wrote to memory of 35803052regsvr32.exerundll32.exe
    PID 3052 wrote to memory of 35803052regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll
    Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll
      Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll",DllRegisterServer
        PID:3580
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/3052-118-0x0000000000000000-mapping.dmp

                            Download

                          • memory/3052-119-0x0000000004491000-0x00000000044B5000-memory.dmp

                            Download

                          • memory/3052-120-0x00000000044B5000-0x00000000044B6000-memory.dmp

                            Download

                          • memory/3580-121-0x0000000000000000-mapping.dmp

                            Download