dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922 | Triage

Resubmissions

18/01/2022, 01:59

220118-ceefxafch7 1

18/01/2022, 01:25

220118-bszhkafad6 10

12/01/2022, 19:02

220112-xptnssdgap 1

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-en-20211208
submitted
18/01/2022, 01:59

Sharing

Report Analysis Logs

General

Target

wTX6pg5eI.dll
Size

470KB
MD5

d7558151521bffa1c84e558f961eed25
SHA1

6ff24d8068ecfe17154c7a9d60acb34e8c3af75e
SHA256

da7fa800740b478f03c7d6b4be655eaaa52b7607a16491f7c0b34da214d08fc4
SHA512

f0a9a98542551b6138cd6e05140ca491e4e2990ae55ee97fbdcedc8fd8c4dfa671b00340e9753c536b614f2b909c14769f7d10cbf0fba03183fbf8a6f6f35779

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 836	964	regsvr32.exe	27
PID 964 wrote to memory of 836	964	regsvr32.exe	27
PID 964 wrote to memory of 836	964	regsvr32.exe	27
PID 964 wrote to memory of 836	964	regsvr32.exe	27
PID 964 wrote to memory of 836	964	regsvr32.exe	27
PID 964 wrote to memory of 836	964	regsvr32.exe	27
PID 964 wrote to memory of 836	964	regsvr32.exe	27
PID 836 wrote to memory of 1488	836	regsvr32.exe	30
PID 836 wrote to memory of 1488	836	regsvr32.exe	30
PID 836 wrote to memory of 1488	836	regsvr32.exe	30
PID 836 wrote to memory of 1488	836	regsvr32.exe	30
PID 836 wrote to memory of 1488	836	regsvr32.exe	30
PID 836 wrote to memory of 1488	836	regsvr32.exe	30
PID 836 wrote to memory of 1488	836	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll",DllRegisterServer
    3⤵
    PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download
memory/836-56-0x0000000000160000-0x0000000000189000-memory.dmp

Filesize
164KB

Download
memory/964-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download