41ecaa19029cb0c7e9b2c4ba8ccf7fd070176d5f2d1217bcc9503d85a74a72f2 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 10:30

Sharing

Report Analysis Logs

General

Target

41ecaa19029cb0c7e9b2c4ba8ccf7fd070176d5f2d1217bcc9503d85a74a72f2.dll
Size

44KB
MD5

2a70d887942ab82210a62704c99913aa
SHA1

bcca694eafd4dc72ada020014fbdd4285e91d391
SHA256

41ecaa19029cb0c7e9b2c4ba8ccf7fd070176d5f2d1217bcc9503d85a74a72f2
SHA512

512c8089409cc7ddb8fbb3858228e44a283d73c49cbf5c2973716bc15c75539fd0b4c838f0c577d219406c749be9e14337a059b3e48467625055f5664b12e343

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1892 wrote to memory of 848	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 848	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 848	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 848	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 848	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 848	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 848	1892	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\41ecaa19029cb0c7e9b2c4ba8ccf7fd070176d5f2d1217bcc9503d85a74a72f2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\41ecaa19029cb0c7e9b2c4ba8ccf7fd070176d5f2d1217bcc9503d85a74a72f2.dll
2⤵
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download
memory/1892-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download