ae687ec5c82060bdf4e00480773abec0cfa4062dc8230c3ae116c185ea2f13fb | Triage™

Analysis

max time kernel
133s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21/03/2022, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae687ec5c82060bdf4e00480773abec0cfa4062dc8230c3ae116c185ea2f13fb.dll
Size 138KB
Sample220321-szaw8adde2
SHA256 ae687ec5c82060bdf4e00480773abec0cfa4062dc8230c3ae116c185ea2f13fb
MD5 fb5f9075588f01db502c1a862e25dd1e
SHA1 4a6dc3186a217e02111ecbe4e1503b9c4476585b
SHA512 7f4a27831297690fd0aaa3881f8fd6f25f9e65c8fb9adbc4138efb5d09b53daef093636553bcfbd0201b1b3b353f114287a59de80a662a3984cae974ab378c7f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	regsvr32.exe
2108	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2108	1920	regsvr32.exe	79
PID 1920 wrote to memory of 2108	1920	regsvr32.exe	79
PID 1920 wrote to memory of 2108	1920	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae687ec5c82060bdf4e00480773abec0cfa4062dc8230c3ae116c185ea2f13fb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ae687ec5c82060bdf4e00480773abec0cfa4062dc8230c3ae116c185ea2f13fb.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads