890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8 | Triage

Resubmissions

10-08-2023 17:07

230810-vmzqxsfe66 10

10-08-2023 16:28

230810-tym1tsfa36 10

01-02-2022 09:54

220201-lxap4sceap 10

Analysis

max time kernel
24s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
01-02-2022 09:54

Sharing

Report Analysis Logs

General

Target

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
Size

251KB
MD5

4c35bc0bb978ae5273a27c7882483eb4
SHA1

e5fb5c5c523e872db6ffd03428f5c0dc74cc9192
SHA256

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8
SHA512

03154958d83f22969e2967425c35c30bd3a402073819cbea4583f147fecae8ca28281f6c4af5c4c883c3d71e2d272dba066f7b524bf185e512f1092e2db520ee

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3512 wrote to memory of 4676	3512	regsvr32.exe	regsvr32.exe
PID 3512 wrote to memory of 4676	3512	regsvr32.exe	regsvr32.exe
PID 3512 wrote to memory of 4676	3512	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3512

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
2⤵
PID:4676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...