Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
04-08-2022 12:43
Static task
static1
Behavioral task
behavioral1
Sample
b59430d733e346aef69dc5992cee0f06d8dbfca7744d212159528c89d1008953.dll
Resource
win10-20220722-en
General
-
Target
b59430d733e346aef69dc5992cee0f06d8dbfca7744d212159528c89d1008953.dll
-
Size
297KB
-
MD5
d38f6f01bb926df07d34de0649f608f6
-
SHA1
8a3bd09ea156ede59f527af01412e66181b6d74c
-
SHA256
b59430d733e346aef69dc5992cee0f06d8dbfca7744d212159528c89d1008953
-
SHA512
73c575e5aa7963ca3d3c8cd2b08c83178030ed3248c215ec766628fad02ece83bb76bf3da613f4591485bf7610e9422eefa3ddbbb53885021338976087395903
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2788 wrote to memory of 4176 2788 regsvr32.exe cmd.exe PID 2788 wrote to memory of 4176 2788 regsvr32.exe cmd.exe PID 2788 wrote to memory of 5020 2788 regsvr32.exe cmd.exe PID 2788 wrote to memory of 5020 2788 regsvr32.exe cmd.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b59430d733e346aef69dc5992cee0f06d8dbfca7744d212159528c89d1008953.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\C6F0.tmp2⤵
-
C:\Windows\system32\cmd.execmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\C6F0.tmp2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\C6F0.tmpFilesize
11B
MD5a67f2061c697fd95f6b28d89b953a51f
SHA16730b864104f0840fcebf04383d2e3ef7c324a48
SHA256d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79
SHA512d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe
-
C:\Users\Admin\AppData\Local\Temp\C6F0.tmpFilesize
3KB
MD5d625c512da41bd4ed822a9144a047873
SHA1ec415ee56a68837cf8debd83942cab41d179f624
SHA25653b3f491b43f588ac293b6f9b951eca6334bf3166faeadee9ae733af22cc7443
SHA51288fd07035d6ebd326db2627ed5093a700f4aa04276e6c22bf3b9fc15197a37197d292d759f5df1bacad845ad335dd8cf2eb28310f4b03cc5644b1282e1d86ac1
-
memory/2788-127-0x0000000180000000-0x0000000180012000-memory.dmpFilesize
72KB
-
memory/4176-132-0x0000000000000000-mapping.dmp
-
memory/5020-133-0x0000000000000000-mapping.dmp