b6651466a46e7f0fa6357a286e9785fcd8e2ea79a57b49a739e56720beaea312 | Triage™

Analysis

max time kernel
20s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05/02/2022, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6651466a46e7f0fa6357a286e9785fcd8e2ea79a57b49a739e56720beaea312.dll
Size 997KB
Sample220205-s2hd3scgg5
SHA256 b6651466a46e7f0fa6357a286e9785fcd8e2ea79a57b49a739e56720beaea312
MD5 7a1ee9a3bd7e28515c2ca76e3503061d
SHA1 6d32afcf06876980d8c62fa77c4149a3bcf3498e
SHA512 d08cecb3466ee38de868aa2192e34389f5e6a1d1f1dc5af4d6f216bf7bae1ee5335e3642a3c858a7812682c6a0c48a1f0d54d68de17b366e6597e9380f85415e
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3652	2880	regsvr32.exe	83
PID 2880 wrote to memory of 3652	2880	regsvr32.exe	83
PID 2880 wrote to memory of 3652	2880	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6651466a46e7f0fa6357a286e9785fcd8e2ea79a57b49a739e56720beaea312.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b6651466a46e7f0fa6357a286e9785fcd8e2ea79a57b49a739e56720beaea312.dll
  2⤵
  PID:3652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads