2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4

General
Target

2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll

Filesize

574KB

Completed

15-01-2022 01:29

Score
1/10
MD5

d315c4fac3a11e1fafe902d8944e9070

SHA1

a788cf7069901d31921b6bf501fa97dd580427e1

SHA256

2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1672 wrote to memory of 34001672regsvr32.exeregsvr32.exe
    PID 1672 wrote to memory of 34001672regsvr32.exeregsvr32.exe
    PID 1672 wrote to memory of 34001672regsvr32.exeregsvr32.exe
    PID 3400 wrote to memory of 38163400regsvr32.exerundll32.exe
    PID 3400 wrote to memory of 38163400regsvr32.exerundll32.exe
    PID 3400 wrote to memory of 38163400regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll
    Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll
      Suspicious use of WriteProcessMemory
      PID:3400
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll",DllRegisterServer
        PID:3816
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3400-115-0x0000000000000000-mapping.dmp

                          • memory/3400-117-0x0000000000805000-0x0000000000806000-memory.dmp

                          • memory/3816-118-0x0000000000000000-mapping.dmp