c4e3db57b6ba8228f896717cbed0777bca133f1352c25517cc97ad0a3a19b032 | Triage™

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
26/01/2022, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lTyn6Tz5.dll
Size 705KB
Sample220126-v27ebafghk
SHA256 c4e3db57b6ba8228f896717cbed0777bca133f1352c25517cc97ad0a3a19b032
MD5 7c1765f1a9a74fcca3e15822b89f837e
SHA1 03e87528e095c5ff5993b358c9a9e89b94bb1b69
SHA512 ea0c56b5c7ecdc3a42112d3f3ca1baaa18a5fd897a3fecc7caa3d1da5c13d5d7bbe7593d82415e672fd9a14415cda41c5d96362b6b606b489279384f34b2ad02
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lTyn6Tz5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\lTyn6Tz5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\lTyn6Tz5.dll",DllRegisterServer
    3⤵
    PID:1452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-53-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Download

memory/1792-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download