9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
14-02-2022 15:23

Sharing

Report Analysis Logs

General

Target

9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
Size

232KB
MD5

17d871a5ff47e98e7b52769bcf28a7dd
SHA1

579ba71ba0fb5ad8fb99920870f9c2901be841e8
SHA256

9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a
SHA512

55afe0d880144e1b16ca603359dba009a29c2b8befc1eea4d27401f4c91bb8a7aaac982fcd964ba45f866bfbc10b75e04f836e23523136e43d57982d201e5a86

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1628 wrote to memory of 1632	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1632	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1632	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1632	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1632	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1632	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1632	1628	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
2⤵
PID:1632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-55-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download