698aecbbd9c885491d3f4db1cc782103d19946973383d2062ed55f51c3106d2a | Triage™

Analysis

max time kernel
123s
max time network
143s
platform
windows10_x64
resource
win10-en-20211208
submitted
25/01/2022, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yzurf.dll
Size 660KB
Sample220125-vbm8rabch6
SHA256 698aecbbd9c885491d3f4db1cc782103d19946973383d2062ed55f51c3106d2a
MD5 94fb071ae47fe796c9f02f73903818e7
SHA1 ce94b51cbe7345bb248eb1ad321691508e9601ca
SHA512 b578f6da6a734c61c1afb810036b04d5f3bf496a977a3f0defaeaded606c1342bb548157f0908d2a42d06bfd9daef9827fbc7f9cbd2dbcb0ee7d72f3eab535be
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1292	1192	regsvr32.exe	69
PID 1192 wrote to memory of 1292	1192	regsvr32.exe	69
PID 1192 wrote to memory of 1292	1192	regsvr32.exe	69
PID 1292 wrote to memory of 2220	1292	regsvr32.exe	70
PID 1292 wrote to memory of 2220	1292	regsvr32.exe	70
PID 1292 wrote to memory of 2220	1292	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\yzurf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\yzurf.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\yzurf.dll",DllRegisterServer
    3⤵
    PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads