b1b4fc6018739eedcee96b39de128b3fb768e273ca4c06aa5a1e1d2129c8216a | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
15-01-2022 01:26

Sharing

Report Analysis Logs

General

Target

b1b4fc6018739eedcee96b39de128b3fb768e273ca4c06aa5a1e1d2129c8216a.dll
Size

574KB
MD5

476ed724c37422578c33371747669460
SHA1

535d53b4a03e9f2205da7301849dfc9217990f7e
SHA256

b1b4fc6018739eedcee96b39de128b3fb768e273ca4c06aa5a1e1d2129c8216a
SHA512

7ee68bd287a8ffe323de652a9835246d5641e1f5632e82f426269033708e3aa0690c9181f3b8a0cd0087173e23ee66f19d59aa61a6f000c29acdd8b40e634ec5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4024 wrote to memory of 4000	4024	regsvr32.exe	regsvr32.exe
PID 4024 wrote to memory of 4000	4024	regsvr32.exe	regsvr32.exe
PID 4024 wrote to memory of 4000	4024	regsvr32.exe	regsvr32.exe
PID 4000 wrote to memory of 3432	4000	regsvr32.exe	rundll32.exe
PID 4000 wrote to memory of 3432	4000	regsvr32.exe	rundll32.exe
PID 4000 wrote to memory of 3432	4000	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b1b4fc6018739eedcee96b39de128b3fb768e273ca4c06aa5a1e1d2129c8216a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\b1b4fc6018739eedcee96b39de128b3fb768e273ca4c06aa5a1e1d2129c8216a.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b1b4fc6018739eedcee96b39de128b3fb768e273ca4c06aa5a1e1d2129c8216a.dll",DllRegisterServer
3⤵
PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3432-118-0x0000000000000000-mapping.dmp

Download
memory/4000-115-0x0000000000000000-mapping.dmp

Download
memory/4000-117-0x0000000002D85000-0x0000000002D86000-memory.dmp

Filesize
4KB

Download
memory/4000-116-0x0000000002D61000-0x0000000002D85000-memory.dmp

Filesize
144KB

Download