Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
9fe2748a5840716451f33a99f4c28a8fb2f574db62e1b0a4b4e58993eab11325.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9fe2748a5840716451f33a99f4c28a8fb2f574db62e1b0a4b4e58993eab11325.dll
Resource
win10v2004-20220812-en
General
-
Target
9fe2748a5840716451f33a99f4c28a8fb2f574db62e1b0a4b4e58993eab11325.dll
-
Size
137KB
-
MD5
356a98c441e063c2028df6318466d83f
-
SHA1
d69311ec348ca4c1a3b8ac5e55a65e4fc37abcb3
-
SHA256
9fe2748a5840716451f33a99f4c28a8fb2f574db62e1b0a4b4e58993eab11325
-
SHA512
441220bbf4a271c6649ac76e6977b870ae8bf9fd994417a899c746a3cde96efd9a71fab6227f4d2a9b483ab8cb7b91616086f533297ea386064c25f33e074669
-
SSDEEP
3072:Dva6tOSk4eJw6BBO/ku0pBTNBoJ5Pn2+mfyGlvo:zPAd4uJTuOPae+Qo
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 916 wrote to memory of 1528 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1528 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1528 916 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9fe2748a5840716451f33a99f4c28a8fb2f574db62e1b0a4b4e58993eab11325.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9fe2748a5840716451f33a99f4c28a8fb2f574db62e1b0a4b4e58993eab11325.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1528-132-0x0000000000000000-mapping.dmp