fb71eaae22e6d93286d10228fc08229b1edf805e5817f698accfe2ec18968458 | Triage

Analysis

max time kernel
32s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
01-02-2022 08:44

Sharing

Report Analysis Logs

General

Target

fb71eaae22e6d93286d10228fc08229b1edf805e5817f698accfe2ec18968458.dll
Size

458KB
MD5

ea7bb99e03606702c1cbe543bb32b27e
SHA1

85e38cc3b78cbb92ade81721d8cec0cb6c34f3b5
SHA256

fb71eaae22e6d93286d10228fc08229b1edf805e5817f698accfe2ec18968458
SHA512

77ef0498a18d8762852d6fa0a27784aef20e2a784d1923f73cda2a742dd94e5efd63e8e9d34d02f2ac9a9a119de03b1030cee2cd33ac50ff03b682ed414178b9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 5028 wrote to memory of 1840	5028	regsvr32.exe	82
PID 5028 wrote to memory of 1840	5028	regsvr32.exe	82
PID 5028 wrote to memory of 1840	5028	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fb71eaae22e6d93286d10228fc08229b1edf805e5817f698accfe2ec18968458.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fb71eaae22e6d93286d10228fc08229b1edf805e5817f698accfe2ec18968458.dll
  2⤵
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads