e8a150d1347a232e358448bfa2173f666c51770eae5b82919e7057c951ac0f05 | Triage™

Analysis

max time kernel
130s
max time network
146s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FaGmyXg.dll
Size 512KB
Sample220127-vdd3vsgafk
SHA256 e8a150d1347a232e358448bfa2173f666c51770eae5b82919e7057c951ac0f05
MD5 de813b9f961c17b8d7e7b986e63ec7de
SHA1 33edec221b52ec6cfb3aa1fa5346759ef61eaa8f
SHA512 f597ad2f83e5f77195b958d35b5282b5937e92b50b7bf36d0f74c6f61fe4fb4877f6be035714124dd367d2d35bc82d21888b4dfb5bb2b09e1e4382dfe5193435
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 920	1896	regsvr32.exe	69
PID 1896 wrote to memory of 920	1896	regsvr32.exe	69
PID 1896 wrote to memory of 920	1896	regsvr32.exe	69
PID 920 wrote to memory of 1000	920	regsvr32.exe	70
PID 920 wrote to memory of 1000	920	regsvr32.exe	70
PID 920 wrote to memory of 1000	920	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\FaGmyXg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\FaGmyXg.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\FaGmyXg.dll",DllRegisterServer
    3⤵
    PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads