a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8 | Triage

Analysis

max time kernel
137s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 05:16

Sharing

Report Analysis Logs

General

Target

急速辅助免费版1120/前锋加速器/SYS.dll
Size

33KB
MD5

36b00f7278553b7402c890ed7bc9a5c5
SHA1

f15442c01d2cfff82f0fb613ff679b450efee73d
SHA256

cdcad8b543d5b078a4869e335aa3a0ccf9099a0baab806d396ad0ca2556aaa45
SHA512

0c27b9f8213cc49d3c3f97a615236dc86ed4d65b41ac0a6a1c596438f7e308a73f7b8cd1b8be4f370cecae8122278bbacf8e7d41aeb9b13ebfc78cc00817f2fe
SSDEEP

384:TmYWDn+cpDTcn6m3JfVlrrrgovC4mMfnYPLhU1vv:iYcn5DYdNprLC4mMfR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3528 wrote to memory of 4072	3528	regsvr32.exe	regsvr32.exe
PID 3528 wrote to memory of 4072	3528	regsvr32.exe	regsvr32.exe
PID 3528 wrote to memory of 4072	3528	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\前锋加速器\SYS.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\前锋加速器\SYS.dll
  2⤵
  PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-133-0x0000000000000000-mapping.dmp

Download