e823ebdccbe9cb156d26d350e08022a748e72c6b5cbc31e8a61b821bd707b4e1 | Triage™

Analysis

max time kernel
121s
max time network
129s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
h4XAT.dll
Size 784KB
Sample220126-nav4mscbbk
SHA256 e823ebdccbe9cb156d26d350e08022a748e72c6b5cbc31e8a61b821bd707b4e1
MD5 c0b90249e5501ea80d5158d5d859a0eb
SHA1 3afb57046c798e636c30869030fb57e9d5bf22e3
SHA512 57fd83c77d789a60d607c18da53d7249681f6fc2354859ed6980bfc5dc85ea38a8cf499fd1885ecd21fbb7b97f9e1b4d1fab4c6f251fd742c8f0ff325b03125f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3492	2764	regsvr32.exe	68
PID 2764 wrote to memory of 3492	2764	regsvr32.exe	68
PID 2764 wrote to memory of 3492	2764	regsvr32.exe	68
PID 3492 wrote to memory of 1864	3492	regsvr32.exe	69
PID 3492 wrote to memory of 1864	3492	regsvr32.exe	69
PID 3492 wrote to memory of 1864	3492	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\h4XAT.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\h4XAT.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\h4XAT.dll",DllRegisterServer
    3⤵
    PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads