ae6ad6e91c5234187e9b336f03fbbb8a6d2f7aec5013db3dcaf4e61c7bc6a4cb | Triage™

Analysis

max time kernel
52s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
04/02/2022, 09:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
756o59An8kLD9gg8.dll
Size 977KB
Sample220204-lgh2jsgegm
SHA256 ae6ad6e91c5234187e9b336f03fbbb8a6d2f7aec5013db3dcaf4e61c7bc6a4cb
MD5 0a9e2de4f1ede8270d5282c449cf54b0
SHA1 74f966b2acb31f0b8cf4e1608e24d331f4cc90e9
SHA512 6d924e2b37ffbc206a6d288ab5ceae571fa0375e7cbd5d0d93060e2815e815c42c23cfe4c4b75a7244657be0725055286faa508ed4a63dc118c9fb65953b1392
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1908	3636	regsvr32.exe	84
PID 3636 wrote to memory of 1908	3636	regsvr32.exe	84
PID 3636 wrote to memory of 1908	3636	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\756o59An8kLD9gg8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\756o59An8kLD9gg8.dll
  2⤵
  PID:1908

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe e93d1de79a5503990b717ee267832bcc 2Px1yS92XU6jVbVHkphlRQ.0.1.0.0.0
1⤵
PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads