0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00 | Triage

Resubmissions

07-07-2022 11:51

220707-n1ffwafher 10

24-12-2021 14:23

211224-rp9r5aedd3 1

24-12-2021 14:21

211224-rn9ezadccp 1

23-12-2021 13:06

211223-qb3wzsafdj 3

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-07-2022 11:51

Sharing

Report Analysis Logs

General

Target

colorui.dll
Size

879KB
MD5

a91ba8f4a339a98fa94e810831e83d96
SHA1

871e52778597185f98eb0a57127024bcd094cf07
SHA256

0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00
SHA512

ac6fb57225f0765f40ee298e12d430d45e5d9b59f16742cb4c32f56b5663c244dad47d7c80a1919e09f4f9edc3ad0ac4645ee6aff9925c5d860651593f0b1a3e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1372 wrote to memory of 864	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 864	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 864	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 864	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 864	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 864	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 864	1372	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\colorui.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\colorui.dll
2⤵
PID:864

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-55-0x0000000000000000-mapping.dmp

Download
memory/864-56-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/1372-54-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

Filesize
8KB

Download