4dbf859d53096e65356805cfcdb0641b37895cc84a5437121018d13013e1ca8d

General
Target

4dbf859d53096e65356805cfcdb0641b37895cc84a5437121018d13013e1ca8d.dll

Filesize

574KB

Completed

15-01-2022 01:35

Score
1/10
MD5

bb2ff222921237a7da0d08d595f55eee

SHA1

170544b7d312ce12f8d616541b6cbda9bbd0d415

SHA256

4dbf859d53096e65356805cfcdb0641b37895cc84a5437121018d13013e1ca8d

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3380 wrote to memory of 37563380regsvr32.exeregsvr32.exe
    PID 3380 wrote to memory of 37563380regsvr32.exeregsvr32.exe
    PID 3380 wrote to memory of 37563380regsvr32.exeregsvr32.exe
    PID 3756 wrote to memory of 36523756regsvr32.exerundll32.exe
    PID 3756 wrote to memory of 36523756regsvr32.exerundll32.exe
    PID 3756 wrote to memory of 36523756regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4dbf859d53096e65356805cfcdb0641b37895cc84a5437121018d13013e1ca8d.dll
    Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\4dbf859d53096e65356805cfcdb0641b37895cc84a5437121018d13013e1ca8d.dll
      Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4dbf859d53096e65356805cfcdb0641b37895cc84a5437121018d13013e1ca8d.dll",DllRegisterServer
        PID:3652
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/3652-118-0x0000000000000000-mapping.dmp

                            Download

                          • memory/3756-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/3756-117-0x00000000033A5000-0x00000000033A6000-memory.dmp

                            Download