925b05f137cea0396c099e9908f007eff1ff73fb865c69fcc67f70c4e601fd81 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
21-01-2022 23:29

Sharing

Report Analysis Logs

General

Target

925b05f137cea0396c099e9908f007eff1ff73fb865c69fcc67f70c4e601fd81.dll
Size

359KB
MD5

a8cd90cc3cc55fdb6a0cb1ac98a8700a
SHA1

dbe253a8550959bbb9cabcb2293c47d00f9141ca
SHA256

925b05f137cea0396c099e9908f007eff1ff73fb865c69fcc67f70c4e601fd81
SHA512

25b40c3dd70050144e0ddb80bf9be6a69f011724f83efe8517217b91888e7633636507df6b913f2b07b7685954b1f4f3fc7d818710201392cced5fb7a9ee4260

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 1128	812	regsvr32.exe	27
PID 812 wrote to memory of 1128	812	regsvr32.exe	27
PID 812 wrote to memory of 1128	812	regsvr32.exe	27
PID 812 wrote to memory of 1128	812	regsvr32.exe	27
PID 812 wrote to memory of 1128	812	regsvr32.exe	27
PID 812 wrote to memory of 1128	812	regsvr32.exe	27
PID 812 wrote to memory of 1128	812	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\925b05f137cea0396c099e9908f007eff1ff73fb865c69fcc67f70c4e601fd81.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\925b05f137cea0396c099e9908f007eff1ff73fb865c69fcc67f70c4e601fd81.dll
  2⤵
  PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1128-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download