5986776cce84b07f4766a6c8183d36a9b30e78434d6a2afaacf40bc1f30df3d6 | Triage™

Analysis

max time kernel
128s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
18/01/2022, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kd9vBRH.dll
Size 479KB
Sample220118-mkdfxaaga2
SHA256 5986776cce84b07f4766a6c8183d36a9b30e78434d6a2afaacf40bc1f30df3d6
MD5 e764f3a18f5b54e3dee0fcdd8daea6de
SHA1 3f543faf3e38308dab544817719f074b522d497c
SHA512 392ab42cdb60181c45a5a95a9d985b307a023952a4352576b8a94802682aeab657c9dd8a7c7361abb1e492c702020a2c5029869846bf976d31be790a3dc22b27
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3952	3788	regsvr32.exe	52
PID 3788 wrote to memory of 3952	3788	regsvr32.exe	52
PID 3788 wrote to memory of 3952	3788	regsvr32.exe	52
PID 3952 wrote to memory of 1364	3952	regsvr32.exe	53
PID 3952 wrote to memory of 1364	3952	regsvr32.exe	53
PID 3952 wrote to memory of 1364	3952	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kd9vBRH.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kd9vBRH.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\kd9vBRH.dll",DllRegisterServer
    3⤵
    PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-130-0x0000000004960000-0x0000000004988000-memory.dmp

Download