cf1bab8d2cf0f9175dece4e8ea529ec8a784d7e6c0c76892ecb7cf476b34d07b | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows10_x64
resource
win10-en-20211208
submitted
15-01-2022 01:55

Sharing

Report Analysis Logs

General

Target

cf1bab8d2cf0f9175dece4e8ea529ec8a784d7e6c0c76892ecb7cf476b34d07b.dll
Size

574KB
MD5

05f0da1beddb3ddf701a95bad604bd61
SHA1

4e0429f1a2ef4fcd1ddbb45e1f44b247adf11089
SHA256

cf1bab8d2cf0f9175dece4e8ea529ec8a784d7e6c0c76892ecb7cf476b34d07b
SHA512

365c0ea1ff277d1f567c5b357c8080e9c1dcc94d94fa1089520bb498cf062c9a6a82ba5692aaf6a4b0786fed51615ad27d1206aba7753c71ee5485637a15f57c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	regsvr32.exe
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	regsvr32.exe
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	regsvr32.exe
PID 2468 wrote to memory of 2728	2468	regsvr32.exe	rundll32.exe
PID 2468 wrote to memory of 2728	2468	regsvr32.exe	rundll32.exe
PID 2468 wrote to memory of 2728	2468	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf1bab8d2cf0f9175dece4e8ea529ec8a784d7e6c0c76892ecb7cf476b34d07b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\cf1bab8d2cf0f9175dece4e8ea529ec8a784d7e6c0c76892ecb7cf476b34d07b.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cf1bab8d2cf0f9175dece4e8ea529ec8a784d7e6c0c76892ecb7cf476b34d07b.dll",DllRegisterServer
3⤵
PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-118-0x0000000000000000-mapping.dmp

Download
memory/2468-119-0x00000000033C1000-0x00000000033E5000-memory.dmp

Filesize
144KB

Download
memory/2468-120-0x00000000033E5000-0x00000000033E6000-memory.dmp

Filesize
4KB

Download
memory/2728-121-0x0000000000000000-mapping.dmp

Download