6cb5c3a0ea7dec228b27cfd06530a6f948dfd74e5d9e5b9919fc616c59470d43 | Triage™

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211208
submitted
28/01/2022, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BFRwB.dll
Size 544KB
Sample220128-ws7t6aaahn
SHA256 6cb5c3a0ea7dec228b27cfd06530a6f948dfd74e5d9e5b9919fc616c59470d43
MD5 79776f0748f0245ef8c94e9061b51282
SHA1 5a6288ee16e52337d1735692ecef47094f834d4a
SHA512 161c51ba7e326b8dda91667ff976151621317fa180b4569ff186d7d8002275439bd530976c267756b6c0c4a1a598823a72c58662856da72b9fab41fda443e533
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1572	764	regsvr32.exe	27
PID 764 wrote to memory of 1572	764	regsvr32.exe	27
PID 764 wrote to memory of 1572	764	regsvr32.exe	27
PID 764 wrote to memory of 1572	764	regsvr32.exe	27
PID 764 wrote to memory of 1572	764	regsvr32.exe	27
PID 764 wrote to memory of 1572	764	regsvr32.exe	27
PID 764 wrote to memory of 1572	764	regsvr32.exe	27
PID 1572 wrote to memory of 1888	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1888	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1888	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1888	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1888	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1888	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1888	1572	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\BFRwB.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\BFRwB.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BFRwB.dll",DllRegisterServer
    3⤵
    PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/1572-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download