dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922 | Triage™

Resubmissions

18/01/2022, 01:59

220118-ceefxafch71

18/01/2022, 01:25

220118-bszhkafad61

12/01/2022, 19:02

220112-xptnssdgap1

Analysis

max time kernel
115s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
18/01/2022, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NTn5cqpa.dll
Size 470KB
Sample220118-ceefxafch7
SHA256 c60f319790c8cf0b2f39046c789428771ed2bf8f4c108d9b6e9c9bf024efd3c2
MD5 e4b28480c44a175190085a79e50aa56c
SHA1 3e43969468de455940920664b28cc0c8139924b6
SHA512 2dfaa66429f27de1a8b86e693f2776eae593b671d1ae385ed3389e7ff528b4582e6a6695474123febfc34749c9aa2308c2b90b5c43bd41cd1d88a5e0a4b12964
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2468	2280	regsvr32.exe	51
PID 2280 wrote to memory of 2468	2280	regsvr32.exe	51
PID 2280 wrote to memory of 2468	2280	regsvr32.exe	51
PID 2468 wrote to memory of 3532	2468	regsvr32.exe	61
PID 2468 wrote to memory of 3532	2468	regsvr32.exe	61
PID 2468 wrote to memory of 3532	2468	regsvr32.exe	61

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll",DllRegisterServer
    3⤵
    PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-130-0x0000000004140000-0x0000000004169000-memory.dmp

Download