ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a | Triage

Analysis

max time kernel
188s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:10

Sharing

Report Analysis Logs

General

Target

mxdbl.pc6.0831/冒险伴侣0831/HYDati.dll
Size

267KB
MD5

f3c7ff06d8e30f813a87f9b3daec4342
SHA1

818150218210639f6ae975b9cd7dcf5fd6f2d23d
SHA256

11d3f2f2ff92d4b90c4b81f07c9dd80a738beb8d187f1126a40c47d68d1c23bb
SHA512

53f7e5c08c75bc5c10d0fb8369ba4405f402d6ddd8abbd665d2d2c0b619a27d5fc03295a47185738b26c3d84a52adb0804889571d02ed5ddd7347ff4bc5b3715
SSDEEP

6144:2z239PKc+Ei8vee1IHYt5WyG86xPO7dlng/2B:DPDtOu5WyG8yPKlJB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1364 wrote to memory of 5060	1364	regsvr32.exe	regsvr32.exe
PID 1364 wrote to memory of 5060	1364	regsvr32.exe	regsvr32.exe
PID 1364 wrote to memory of 5060	1364	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\HYDati.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\HYDati.dll
2⤵
PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5060-132-0x0000000000000000-mapping.dmp

Download