8f14d5e79a61b14fe86d3263cb6256debeecdbb54fdc52ba7a400ef3bf911b65 | Triage™

Analysis

max time kernel
119s
max time network
130s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
au.dll
Size 512KB
Sample220127-t1e31agdc5
SHA256 8f14d5e79a61b14fe86d3263cb6256debeecdbb54fdc52ba7a400ef3bf911b65
MD5 acce6bc423c96390fad5b72373c59f54
SHA1 ac67b8831c67ac98bad6a140d5cadb0427321f41
SHA512 8959ecbb6cd7df42aa2df6a83881f1a2f534100d57ad913a2e1d6bbee6a8eecfd01599559e3f4fc8abcfb4c092c015509c24a2d572661ef26d127db1e74f709f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2540	2440	regsvr32.exe	68
PID 2440 wrote to memory of 2540	2440	regsvr32.exe	68
PID 2440 wrote to memory of 2540	2440	regsvr32.exe	68
PID 2540 wrote to memory of 3016	2540	regsvr32.exe	69
PID 2540 wrote to memory of 3016	2540	regsvr32.exe	69
PID 2540 wrote to memory of 3016	2540	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\au.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\au.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\au.dll",DllRegisterServer
    3⤵
    PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads