dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922 | Triage

Resubmissions

18-01-2022 01:59

220118-ceefxafch7 1

18-01-2022 01:25

220118-bszhkafad6 10

12-01-2022 19:02

220112-xptnssdgap 1

Analysis

max time kernel
115s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
18-01-2022 01:59

Sharing

Report Analysis Logs

General

Target

NTn5cqpa.dll
Size

470KB
MD5

e4b28480c44a175190085a79e50aa56c
SHA1

3e43969468de455940920664b28cc0c8139924b6
SHA256

c60f319790c8cf0b2f39046c789428771ed2bf8f4c108d9b6e9c9bf024efd3c2
SHA512

2dfaa66429f27de1a8b86e693f2776eae593b671d1ae385ed3389e7ff528b4582e6a6695474123febfc34749c9aa2308c2b90b5c43bd41cd1d88a5e0a4b12964

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	Process	procid_target
PID 2280 wrote to memory of 2468	2280	regsvr32.exe	51
PID 2280 wrote to memory of 2468	2280	regsvr32.exe	51
PID 2280 wrote to memory of 2468	2280	regsvr32.exe	51
PID 2468 wrote to memory of 3532	2468	regsvr32.exe	61
PID 2468 wrote to memory of 3532	2468	regsvr32.exe	61
PID 2468 wrote to memory of 3532	2468	regsvr32.exe	61

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll",DllRegisterServer
    3⤵
    PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-130-0x0000000004140000-0x0000000004169000-memory.dmp

Filesize
164KB

Download