850497ed0130a5247a6c4650bca0af4be152be4cb88cca142b88df6fed854cd3 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
21-01-2022 23:34

Sharing

Report Analysis Logs

General

Target

850497ed0130a5247a6c4650bca0af4be152be4cb88cca142b88df6fed854cd3.dll
Size

375KB
MD5

e9b6075238f35208a15b1da622669107
SHA1

5092693d0456bdcd5ee99999341577af9421ba59
SHA256

850497ed0130a5247a6c4650bca0af4be152be4cb88cca142b88df6fed854cd3
SHA512

4d86acd54ce112774dadd71cce8c4d6f83ebfcc414f583e1e9f861655ec03f45098b60b5ae8177ff6ea8a99b749c5befa8ece52cc92dc60dcff716c7c0dc8bc8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1892	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1892	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1892	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1892	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1892	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1892	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1892	1536	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\850497ed0130a5247a6c4650bca0af4be152be4cb88cca142b88df6fed854cd3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\850497ed0130a5247a6c4650bca0af4be152be4cb88cca142b88df6fed854cd3.dll
  2⤵
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download
memory/1892-55-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download