b4c9bbd996be7e80fb07819f1e765be56c0eed5940079de70b03cde9add745e6 | Triage

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 06:52

Sharing

Report Analysis Logs

General

Target

calc.exe
Size

758KB
MD5

60b7c0fead45f2066e5b805a91f4f0fc
SHA1

9018a7d6cdbe859a430e8794e73381f77c840be0
SHA256

80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22
SHA512

68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

calc.exe

description	pid	process	target process
PID 2380 wrote to memory of 3016	2380	calc.exe	regsvr32.exe
PID 2380 wrote to memory of 3016	2380	calc.exe	regsvr32.exe
PID 2380 wrote to memory of 3016	2380	calc.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\calc.exe
"C:\Users\Admin\AppData\Local\Temp\calc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe 102755.dll
2⤵
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-130-0x0000000000000000-mapping.dmp

Download
memory/3016-131-0x0000000000700000-0x00000000007AE000-memory.dmp

Filesize
696KB

Download