0d4e2d8aa682727ceda9ca7820965e7a2c87a7812e31abbc30d3eb7b43c9ac56 | Triage™

Analysis

max time kernel
110s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
y0vHGInzn.dll
Size 784KB
Sample220126-ql86radbbj
SHA256 0d4e2d8aa682727ceda9ca7820965e7a2c87a7812e31abbc30d3eb7b43c9ac56
MD5 ff9a3f6b855d9783fdd6d7ebef505c5d
SHA1 1d108c9cc8d7303d5a88b90a160c115bfc3e1d71
SHA512 7d19dde597acbf7c2d322ac4c69e738f8f28d48db2abc28e375d6dbf7d66f075f1fd6e58289ed65c3592da368f043d0866849c2972c1c6cc5e28c5a383b9d6a9
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2816	2624	regsvr32.exe	68
PID 2624 wrote to memory of 2816	2624	regsvr32.exe	68
PID 2624 wrote to memory of 2816	2624	regsvr32.exe	68
PID 2816 wrote to memory of 3920	2816	regsvr32.exe	69
PID 2816 wrote to memory of 3920	2816	regsvr32.exe	69
PID 2816 wrote to memory of 3920	2816	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\y0vHGInzn.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\y0vHGInzn.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\y0vHGInzn.dll",DllRegisterServer
    3⤵
    PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads