e5f9cc95bf5794ff3b23cbb3be2f2536b923cdf128e95f36384d0a2010e1b4d8 | Triage™

Analysis

max time kernel
23s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05/02/2022, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5f9cc95bf5794ff3b23cbb3be2f2536b923cdf128e95f36384d0a2010e1b4d8.dll
Size 997KB
Sample220205-s9zckachd7
SHA256 e5f9cc95bf5794ff3b23cbb3be2f2536b923cdf128e95f36384d0a2010e1b4d8
MD5 3e801b02101f30954ea85b9da492baa4
SHA1 ec26b464b931616955c799487dba6095871617a8
SHA512 bcfbd2a9d3de72e608e4d6c7280d20a9dd60ef35609ba2a1cb9b4cb275ef16cbdce5baf8ecb98f2fa048bb8ef07b0e43fed5a76e4c076b343d05d0393d71407a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1124	4912	regsvr32.exe	81
PID 4912 wrote to memory of 1124	4912	regsvr32.exe	81
PID 4912 wrote to memory of 1124	4912	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5f9cc95bf5794ff3b23cbb3be2f2536b923cdf128e95f36384d0a2010e1b4d8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e5f9cc95bf5794ff3b23cbb3be2f2536b923cdf128e95f36384d0a2010e1b4d8.dll
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads