d9718394c6c28e85ea09bc6a328dd7b1d9a9171072ae9ac059e519d71e1d4492 | Triage

Analysis

max time kernel
150s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:46

Sharing

Report Analysis Logs

General

Target

DNF绝情阁模型工具/gj/exrpg.com/Bin32/COMCTL32.dll
Size

600KB
MD5

fc9fef25cd6620d5691375f392b0fdc8
SHA1

fdddec932d2842d94459e86212e17a88f9ce2c77
SHA256

4f97aa44d3f5ecab907908d44a2cccd73ad67193fc10084ee1ba01577d9ad384
SHA512

c2f3907d20efe2f71c7d5cd43d84f631a1adef4664c2de7b802ce2b766417906a22e534d771b29d6b29c6889f6045bcdfe91269a093c9a5af859c97c4f3ce137
SSDEEP

12288:vYlDBA42IWCjyS+quSdlpXaKKPQJIkFXEhShI:v49AdQyWrK4Wm0UhI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4156 wrote to memory of 400	4156	regsvr32.exe	regsvr32.exe
PID 4156 wrote to memory of 400	4156	regsvr32.exe	regsvr32.exe
PID 4156 wrote to memory of 400	4156	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DNF绝情阁模型工具\gj\exrpg.com\Bin32\COMCTL32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4156

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\DNF绝情阁模型工具\gj\exrpg.com\Bin32\COMCTL32.dll
2⤵
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-132-0x0000000000000000-mapping.dmp

Download