dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6

General

Target

dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe
Size

91KB
MD5

63706406a0a243c739f15f4a110bf9f2
SHA1

ccfbdf558737a37fa0ea21fa2866b245b00bd3f8
SHA256

dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6
SHA512

93f98f36e57d306903e78e46732db9cdd186fbf2ae7916b4e34ae47c225385d87af4212633260db5cf4326d5d991b1602638bf53cd16d5959ce542e5a38d39bf
SSDEEP

1536:0Y5QjE9xp1xB18pufIPkzxvWgcYCGbBRcb0WBPB9H7FPXiO5HSnouy8:00r9P1r7wPUO7ShiBl7FfiO5HKout

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1980-56-0x0000000000400000-0x0000000000499000-memory.dmp	upx
behavioral1/memory/1980-67-0x0000000000400000-0x0000000000499000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exedd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

pid process

1452 regsvr32.exe
1980 dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

pid	process
1452	regsvr32.exe
1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

Drops file in System32 directory 1 IoCs

Processes:

dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

1080 sc.exe
1408 sc.exe

pid	process
1080	sc.exe
1408	sc.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

pid process

1980 dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

pid	process
1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.execmd.exe

description	pid	process	target process
PID 1980 wrote to memory of 1452	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	regsvr32.exe
PID 1980 wrote to memory of 1452	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	regsvr32.exe
PID 1980 wrote to memory of 1452	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	regsvr32.exe
PID 1980 wrote to memory of 1452	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	regsvr32.exe
PID 1980 wrote to memory of 1452	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	regsvr32.exe
PID 1980 wrote to memory of 1452	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	regsvr32.exe
PID 1980 wrote to memory of 1452	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	regsvr32.exe
PID 1980 wrote to memory of 940	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	cmd.exe
PID 1980 wrote to memory of 940	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	cmd.exe
PID 1980 wrote to memory of 940	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	cmd.exe
PID 1980 wrote to memory of 940	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	cmd.exe
PID 940 wrote to memory of 1076	940	cmd.exe	cacls.exe
PID 940 wrote to memory of 1076	940	cmd.exe	cacls.exe
PID 940 wrote to memory of 1076	940	cmd.exe	cacls.exe
PID 940 wrote to memory of 1076	940	cmd.exe	cacls.exe
PID 1980 wrote to memory of 1080	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe
PID 1980 wrote to memory of 1080	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe
PID 1980 wrote to memory of 1080	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe
PID 1980 wrote to memory of 1080	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe
PID 1980 wrote to memory of 1408	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe
PID 1980 wrote to memory of 1408	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe
PID 1980 wrote to memory of 1408	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe
PID 1980 wrote to memory of 1408	1980	dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe
"C:\Users\Admin\AppData\Local\Temp\dd67df06ae2c6c81239557bc8b176b173e1f8e78fb9463512d086a9a0c4a21f6.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\system32\MSWINSCK.OCX"
2⤵
- Loads dropped DLL
- Modifies registry class
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls "C:\Program Files (x86)\E-yoo\EyooSechelper2.dll" /e /d everyone
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\E-yoo\EyooSechelper2.dll" /e /d everyone
3⤵
PID:1076

C:\Windows\SysWOW64\sc.exe
sc config winmgmt start= demand
2⤵
- Launches sc.exe
PID:1080

C:\Windows\SysWOW64\sc.exe
sc start winmgmt
2⤵
- Launches sc.exe
PID:1408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
memory/940-62-0x0000000000000000-mapping.dmp

Download
memory/1076-63-0x0000000000000000-mapping.dmp

Download
memory/1080-64-0x0000000000000000-mapping.dmp

Download
memory/1408-65-0x0000000000000000-mapping.dmp

Download
memory/1452-57-0x0000000000000000-mapping.dmp

Download
memory/1452-58-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1980-67-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads