b95744c8165a45581b734de9a2c44a7552336cbcce9524102dc9e758d992451f | Triage

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:00

Sharing

Report Analysis Logs

General

Target

ǰ/SYS.dll
Size

33KB
MD5

36b00f7278553b7402c890ed7bc9a5c5
SHA1

f15442c01d2cfff82f0fb613ff679b450efee73d
SHA256

cdcad8b543d5b078a4869e335aa3a0ccf9099a0baab806d396ad0ca2556aaa45
SHA512

0c27b9f8213cc49d3c3f97a615236dc86ed4d65b41ac0a6a1c596438f7e308a73f7b8cd1b8be4f370cecae8122278bbacf8e7d41aeb9b13ebfc78cc00817f2fe
SSDEEP

384:TmYWDn+cpDTcn6m3JfVlrrrgovC4mMfnYPLhU1vv:iYcn5DYdNprLC4mMfR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 240	1968	regsvr32.exe	28
PID 1968 wrote to memory of 240	1968	regsvr32.exe	28
PID 1968 wrote to memory of 240	1968	regsvr32.exe	28
PID 1968 wrote to memory of 240	1968	regsvr32.exe	28
PID 1968 wrote to memory of 240	1968	regsvr32.exe	28
PID 1968 wrote to memory of 240	1968	regsvr32.exe	28
PID 1968 wrote to memory of 240	1968	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ǰ\SYS.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ǰ\SYS.dll
  2⤵
  PID:240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-56-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1968-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download