Analysis
-
max time kernel
23s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 18:03
Behavioral task
behavioral1
Sample
6a441734b34cdee31a01164140b0c88966fbb4358dcb63a14ae6824f09e9476f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6a441734b34cdee31a01164140b0c88966fbb4358dcb63a14ae6824f09e9476f.dll
Resource
win10v2004-20220812-en
General
-
Target
6a441734b34cdee31a01164140b0c88966fbb4358dcb63a14ae6824f09e9476f.dll
-
Size
768KB
-
MD5
685a38092179c2e5602c06faba7287e6
-
SHA1
986f69a43e0bf174f73139785ec8f969acf5aa55
-
SHA256
6a441734b34cdee31a01164140b0c88966fbb4358dcb63a14ae6824f09e9476f
-
SHA512
1781d2e6dc467102f4df2d0c44ccffc40024482a50b2c9bc0b43ef58355d5baef431ab8011a21963ae9864676726f7a930e1f8cd4c21fd5ec4209586454c68ac
-
SSDEEP
12288:EPdF891nFoMWTbeuTDQg993x/f5NAgt2TBvU8iuLZCmcg1psp:EfntRbrae7mS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1664 wrote to memory of 1932 1664 regsvr32.exe regsvr32.exe PID 1664 wrote to memory of 1932 1664 regsvr32.exe regsvr32.exe PID 1664 wrote to memory of 1932 1664 regsvr32.exe regsvr32.exe PID 1664 wrote to memory of 1932 1664 regsvr32.exe regsvr32.exe PID 1664 wrote to memory of 1932 1664 regsvr32.exe regsvr32.exe PID 1664 wrote to memory of 1932 1664 regsvr32.exe regsvr32.exe PID 1664 wrote to memory of 1932 1664 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a441734b34cdee31a01164140b0c88966fbb4358dcb63a14ae6824f09e9476f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6a441734b34cdee31a01164140b0c88966fbb4358dcb63a14ae6824f09e9476f.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-54-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmpFilesize
8KB
-
memory/1932-55-0x0000000000000000-mapping.dmp
-
memory/1932-56-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1932-60-0x00000000001D0000-0x000000000020F000-memory.dmpFilesize
252KB
-
memory/1932-63-0x0000000000190000-0x0000000000210000-memory.dmpFilesize
512KB
-
memory/1932-64-0x0000000000190000-0x0000000000210000-memory.dmpFilesize
512KB