5d469ef57ce5b67cd385cc63df4b1b8e47853d488c7fe3bcef60a2d4ae3e6643 | Triage™

Analysis

max time kernel
113s
max time network
136s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/01/2022, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yDEN1No.dll
Size 544KB
Sample220128-ws75xsadc7
SHA256 5d469ef57ce5b67cd385cc63df4b1b8e47853d488c7fe3bcef60a2d4ae3e6643
MD5 300aa79158a402bf6b7d4c59e383cb24
SHA1 67bb0105b5f749d983abe0069f85c6117094a063
SHA512 7071424f3895cc40d12260c959d174d95f6e8c69e5ad461219653602759c968014ff776711ac201344f01303eba1e813aec3ccfffb261190e5f1a41f717180e7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 812	3192	regsvr32.exe	69
PID 3192 wrote to memory of 812	3192	regsvr32.exe	69
PID 3192 wrote to memory of 812	3192	regsvr32.exe	69
PID 812 wrote to memory of 3724	812	regsvr32.exe	70
PID 812 wrote to memory of 3724	812	regsvr32.exe	70
PID 812 wrote to memory of 3724	812	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\yDEN1No.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\yDEN1No.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\yDEN1No.dll",DllRegisterServer
    3⤵
    PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads