04c40a669fcfcd20bd429cbe4f78c71e8403ca70f804262a24024cb40dba321b | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-11-2022 06:47

Sharing

Report Analysis Logs

General

Target

28BEE1E0000.dll
Size

180KB
MD5

b197b4b9d825a927bac9f3d215b5e3f0
SHA1

099e7d6c295905678771402195088bbf087175a9
SHA256

04c40a669fcfcd20bd429cbe4f78c71e8403ca70f804262a24024cb40dba321b
SHA512

31f7c5fed94f341c55d1326c7df5a0441ea93ca6ba3b4820f0a4f04cc3cbe7380df0e04a1932a42a7c5c7074ef0ef61ec98e687c000826218ae0932d99bf404a
SSDEEP

3072:OCS65TUo7WInfB2A5MNJgEqVw7UPej+1Ae7swyo8sTYBA:bJ5TUoznfUbgEqCI1lcsTYy

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1764 regsvr32.exe
1756 regsvr32.exe
1756 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1764 regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1764 wrote to memory of 1756	1764	regsvr32.exe	regsvr32.exe
PID 1764 wrote to memory of 1756	1764	regsvr32.exe	regsvr32.exe
PID 1764 wrote to memory of 1756	1764	regsvr32.exe	regsvr32.exe
PID 1764 wrote to memory of 1756	1764	regsvr32.exe	regsvr32.exe
PID 1764 wrote to memory of 1756	1764	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\28BEE1E0000.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RyGJd\xSKjOZZwcPine.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-55-0x0000000000000000-mapping.dmp

Download
memory/1764-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

Filesize
8KB

Download