7053c10fc8ee8b9f27ba7cdcd6a14bda48fa75df99adfb421be7f9ebe0e64e2f | Triage™

Analysis

max time kernel
119s
max time network
138s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ssd.dll
Size 496KB
Sample220127-k3xldsaee7
SHA256 7053c10fc8ee8b9f27ba7cdcd6a14bda48fa75df99adfb421be7f9ebe0e64e2f
MD5 f46b7d8f0bb1d55aadab45a75130b04b
SHA1 1bac41121d1786922c00650cdb33417f1cee9502
SHA512 6e86702893542ba62e1dea12a91ff06af15dd284e955e5b2e135c66eb37b8b3797913fd51064d01244736d9bf710eaaa5fbb673ab33f2800ad2c914d9b7e581c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 660	3080	regsvr32.exe	69
PID 3080 wrote to memory of 660	3080	regsvr32.exe	69
PID 3080 wrote to memory of 660	3080	regsvr32.exe	69
PID 660 wrote to memory of 3464	660	regsvr32.exe	70
PID 660 wrote to memory of 3464	660	regsvr32.exe	70
PID 660 wrote to memory of 3464	660	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ssd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ssd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ssd.dll",DllRegisterServer
    3⤵
    PID:3464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads