Resubmissions
19-04-2022 06:55
220419-hp816aded9 719-04-2022 06:28
220419-g8bdkahaep 1018-04-2022 14:00
220418-razzdaadgr 10Analysis
-
max time kernel
489s -
max time network
515s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-04-2022 06:55
General
-
Target
e4-5375ff373df38f4dde8f1b1dbcb3b31b.dll
-
Size
418KB
-
MD5
5375ff373df38f4dde8f1b1dbcb3b31b
-
SHA1
8ce588d597c71834e5c7dc15ab1edfeca579e4ea
-
SHA256
a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd
-
SHA512
886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4-5375ff373df38f4dde8f1b1dbcb3b31b.dll1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\Gdqji\aexajmztrjuzb.fig"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD55375ff373df38f4dde8f1b1dbcb3b31b
SHA18ce588d597c71834e5c7dc15ab1edfeca579e4ea
SHA256a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd
SHA512886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51
-
Filesize
172KB
-