257de8bd0f933badece38d47bf6eb103f87a2ecf93f531537a7c800e06e419c1 | Triage™

Analysis

max time kernel
24s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
07/02/2022, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yNqNe4O8Uc.dll
Size 997KB
Sample220207-kl2tsaabg7
SHA256 257de8bd0f933badece38d47bf6eb103f87a2ecf93f531537a7c800e06e419c1
MD5 bfe91fa50b8a6dcd5bb722ead99c1588
SHA1 0b4fa8218d822492622806940a2bc5c64938956b
SHA512 52f2f275c4b79cb2a3b22519b8d0cdf2647901b6bb5856ecd5adff3df577bafe9ede4fa57dd318917704be4cec6a143c4708fc7b686df179e30093d402752a9c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1540	4720	regsvr32.exe	82
PID 4720 wrote to memory of 1540	4720	regsvr32.exe	82
PID 4720 wrote to memory of 1540	4720	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\yNqNe4O8Uc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\yNqNe4O8Uc.dll
  2⤵
  PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads