dfe10a2dae9904116c65ddd1a0384297e88e40ba23b6cc43d7cb1dcd54025ba9 | Triage

Analysis

max time kernel
111s
max time network
126s
platform
windows10_x64
resource
win10-en-20211208
submitted
15-01-2022 01:33

Sharing

Report Analysis Logs

General

Target

dfe10a2dae9904116c65ddd1a0384297e88e40ba23b6cc43d7cb1dcd54025ba9.dll
Size

574KB
MD5

e2167e80f67a069af36c09d0659cf435
SHA1

d730d73e0fe78970ca234f961012c715121386df
SHA256

dfe10a2dae9904116c65ddd1a0384297e88e40ba23b6cc43d7cb1dcd54025ba9
SHA512

347a13e1d99b26d70c5ccb8cfdf5f3b67cc868c82a3d5548634161475a08e468433c33fb6c5f1befedf8d81c3ab473293447663b85e85320cd38ce0345e023e8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2808 wrote to memory of 3684	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3684	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3684	2808	regsvr32.exe	regsvr32.exe
PID 3684 wrote to memory of 1420	3684	regsvr32.exe	rundll32.exe
PID 3684 wrote to memory of 1420	3684	regsvr32.exe	rundll32.exe
PID 3684 wrote to memory of 1420	3684	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dfe10a2dae9904116c65ddd1a0384297e88e40ba23b6cc43d7cb1dcd54025ba9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\dfe10a2dae9904116c65ddd1a0384297e88e40ba23b6cc43d7cb1dcd54025ba9.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dfe10a2dae9904116c65ddd1a0384297e88e40ba23b6cc43d7cb1dcd54025ba9.dll",DllRegisterServer
3⤵
PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-118-0x0000000000000000-mapping.dmp

Download
memory/3684-115-0x0000000000000000-mapping.dmp

Download
memory/3684-117-0x0000000000875000-0x0000000000876000-memory.dmp

Filesize
4KB

Download
memory/3684-116-0x0000000000851000-0x0000000000875000-memory.dmp

Filesize
144KB

Download