0d4e2d8aa682727ceda9ca7820965e7a2c87a7812e31abbc30d3eb7b43c9ac56 | Triage™

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-en-20211208
submitted
26/01/2022, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
y0vHGInzn.dll
Size 784KB
Sample220126-ql86radbbj
SHA256 0d4e2d8aa682727ceda9ca7820965e7a2c87a7812e31abbc30d3eb7b43c9ac56
MD5 ff9a3f6b855d9783fdd6d7ebef505c5d
SHA1 1d108c9cc8d7303d5a88b90a160c115bfc3e1d71
SHA512 7d19dde597acbf7c2d322ac4c69e738f8f28d48db2abc28e375d6dbf7d66f075f1fd6e58289ed65c3592da368f043d0866849c2972c1c6cc5e28c5a383b9d6a9
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1736 wrote to memory of 528	1736	regsvr32.exe	28
PID 1736 wrote to memory of 528	1736	regsvr32.exe	28
PID 1736 wrote to memory of 528	1736	regsvr32.exe	28
PID 1736 wrote to memory of 528	1736	regsvr32.exe	28
PID 1736 wrote to memory of 528	1736	regsvr32.exe	28
PID 1736 wrote to memory of 528	1736	regsvr32.exe	28
PID 1736 wrote to memory of 528	1736	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\y0vHGInzn.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\y0vHGInzn.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\y0vHGInzn.dll",DllRegisterServer
    3⤵
    PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-55-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download

memory/1736-56-0x0000000076851000-0x0000000076853000-memory.dmp

Download