dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922 | Triage

Resubmissions

18/01/2022, 01:59

220118-ceefxafch7 1

18/01/2022, 01:25

220118-bszhkafad6 10

12/01/2022, 19:02

220112-xptnssdgap 1

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-en-20211208
submitted
18/01/2022, 01:59

Sharing

Report Analysis Logs

General

Target

NTn5cqpa.dll
Size

470KB
MD5

e4b28480c44a175190085a79e50aa56c
SHA1

3e43969468de455940920664b28cc0c8139924b6
SHA256

c60f319790c8cf0b2f39046c789428771ed2bf8f4c108d9b6e9c9bf024efd3c2
SHA512

2dfaa66429f27de1a8b86e693f2776eae593b671d1ae385ed3389e7ff528b4582e6a6695474123febfc34749c9aa2308c2b90b5c43bd41cd1d88a5e0a4b12964

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 744	1084	regsvr32.exe	27
PID 1084 wrote to memory of 744	1084	regsvr32.exe	27
PID 1084 wrote to memory of 744	1084	regsvr32.exe	27
PID 1084 wrote to memory of 744	1084	regsvr32.exe	27
PID 1084 wrote to memory of 744	1084	regsvr32.exe	27
PID 1084 wrote to memory of 744	1084	regsvr32.exe	27
PID 1084 wrote to memory of 744	1084	regsvr32.exe	27
PID 744 wrote to memory of 532	744	regsvr32.exe	29
PID 744 wrote to memory of 532	744	regsvr32.exe	29
PID 744 wrote to memory of 532	744	regsvr32.exe	29
PID 744 wrote to memory of 532	744	regsvr32.exe	29
PID 744 wrote to memory of 532	744	regsvr32.exe	29
PID 744 wrote to memory of 532	744	regsvr32.exe	29
PID 744 wrote to memory of 532	744	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll",DllRegisterServer
    3⤵
    PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-55-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/744-56-0x00000000001F0000-0x0000000000219000-memory.dmp

Filesize
164KB

Download
memory/1084-54-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Filesize
8KB

Download