adf08f8d41920c087cefcfcffdcf2058fd0b75a64f8e66a4215c58a4851661ee | Triage

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 22:21

Sharing

Report Analysis Logs

General

Target

dwusplay.dll
Size

24KB
MD5

3fea9d2edf23b0283c7a66c8dea380bd
SHA1

6b18a6e3033fe8fdde7a26d47e62ddcd8aaf18a5
SHA256

a1f53e3202dd73edd3a8d8d37b4e5671eba6ab26a7793fe6ef65a1f38a0eae18
SHA512

0985f6b1f410a8440a45882a5bebc08b1538b52a3eeedaa21a736692d3d3fca2dbba05992a7643f2bde2540e31d87d28bf0ed07fc6a785eee5cc461c0b872bf1
SSDEEP

48:SdrllOC21BEM8ipPI7eOrdwzwnAceVt1FiwVO1nN0wdm6Hn:44BR8ip5OrdwQAc8fW1Zbn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2040	1184	regsvr32.exe	27
PID 1184 wrote to memory of 2040	1184	regsvr32.exe	27
PID 1184 wrote to memory of 2040	1184	regsvr32.exe	27
PID 1184 wrote to memory of 2040	1184	regsvr32.exe	27
PID 1184 wrote to memory of 2040	1184	regsvr32.exe	27
PID 1184 wrote to memory of 2040	1184	regsvr32.exe	27
PID 1184 wrote to memory of 2040	1184	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dwusplay.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dwusplay.dll
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download