b86a1529079e22bcb551e1986dc9faad03f8b8b5b41b56adbc614102d19c1216 | Triage

Analysis

max time kernel
49s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-04-2022 01:58

Sharing

Report Analysis Logs

General

Target

b86a1529079e22bcb551e1986dc9faad03f8b8b5b41b56adbc614102d19c1216.dll
Size

13KB
MD5

b5156cccd87caf6b06d7b59058c9c69f
SHA1

0635c8fe0cdb43ec5ca65f526f2a971005eee94b
SHA256

b86a1529079e22bcb551e1986dc9faad03f8b8b5b41b56adbc614102d19c1216
SHA512

a5b7ab1cf84880ae936c08e3005bbd0b77295eb5448c01919a12fb6025c67406aa1e1567ceb2e92a99ee9137d267e75a8b32ab0565bfb65229503e199f3902ff

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

2560 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

regsvr32.exe

description pid process

Token: SeDebugPrivilege 2560 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b86a1529079e22bcb551e1986dc9faad03f8b8b5b41b56adbc614102d19c1216.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-130-0x0000000002A60000-0x0000000002A62000-memory.dmp

Filesize
8KB

Download
memory/2560-131-0x00007FFF94D90000-0x00007FFF95851000-memory.dmp

Filesize
10.8MB

Download
memory/2560-132-0x000000001D940000-0x000000001D962000-memory.dmp

Filesize
136KB

Download