3601bea7085bd103676b29f7eaa7becf1ea66ac5ec2e1a2c930a3e4ad69899d6 | Triage™

Analysis

max time kernel
121s
max time network
129s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
565.dll
Size 784KB
Sample220126-lr74esbgh3
SHA256 3601bea7085bd103676b29f7eaa7becf1ea66ac5ec2e1a2c930a3e4ad69899d6
MD5 65bd6c7c0ef569b15ddde21d7c3817d5
SHA1 c8f3ab859dd1a692ee19f24eba2c6f91914ab52e
SHA512 4fefd6a547377c55cc9343ef9a79c3bbb1463f1271cadee20421232eff8cdb296e9ee3dc6c9a18ac9b25e29927c466527069ba23691937d6e8666c0b9269d9b4
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3676	3364	regsvr32.exe	68
PID 3364 wrote to memory of 3676	3364	regsvr32.exe	68
PID 3364 wrote to memory of 3676	3364	regsvr32.exe	68
PID 3676 wrote to memory of 3648	3676	regsvr32.exe	69
PID 3676 wrote to memory of 3648	3676	regsvr32.exe	69
PID 3676 wrote to memory of 3648	3676	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\565.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\565.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\565.dll",DllRegisterServer
    3⤵
    PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads