Analysis

  • max time kernel
    45s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2022 04:10

General

  • Target

    35e00465cd71dafe1be7b4996761dc0f3585f9b9ca41c440dd8e4beb3c568b9d.dll

  • Size

    62KB

  • MD5

    6828c80c8681f1d6b0c31a3be19e4aa0

  • SHA1

    e4e8de8f6f116f214160077f649662eaff94451a

  • SHA256

    35e00465cd71dafe1be7b4996761dc0f3585f9b9ca41c440dd8e4beb3c568b9d

  • SHA512

    69f370ab46dcb837dfd4269c5dc7be12d50dd68f9238839f68d41cbf59fb245e948033de8e139089db5d741c8807cf967bc3a8d24586f250aa173cb36e42405c

  • SSDEEP

    1536:pONLMA9AzZf7NjAjN5rYoYnNvQewA1NJgHb6BeA4kKmO:c1d9sTNQ5reNYeFObZAH

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\35e00465cd71dafe1be7b4996761dc0f3585f9b9ca41c440dd8e4beb3c568b9d.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\35e00465cd71dafe1be7b4996761dc0f3585f9b9ca41c440dd8e4beb3c568b9d.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:1160

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1160-55-0x0000000000000000-mapping.dmp

  • memory/1160-56-0x00000000762E1000-0x00000000762E3000-memory.dmp

    Filesize

    8KB

  • memory/1284-54-0x000007FEFC211000-0x000007FEFC213000-memory.dmp

    Filesize

    8KB