Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2022 21:18

General

  • Target

    8f437dc4313fbd192a0d837c10e2cbc4dbb8bfb51c60d0d693e9071d2c260a84.dll

  • Size

    121KB

  • MD5

    38ce1ad2eadcf2989f3fe12c58f94a0d

  • SHA1

    410fbaa6af3fbd56925e87ce3a1fea323154725b

  • SHA256

    8f437dc4313fbd192a0d837c10e2cbc4dbb8bfb51c60d0d693e9071d2c260a84

  • SHA512

    63d77afaab36047fe232aa35adcf19a267629bddbea96688affa2ccf6e1e1f679196f5f74511b05e76f5e5802635433205ba177c010637016ba932365fccf8aa

  • SSDEEP

    3072:kYfCPGym+iJB9TSrXwlQjsV5jYtq0xV4zfknfziQLTgz:kYfCOF+ifs4FY4w47W+QLU

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 51 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8f437dc4313fbd192a0d837c10e2cbc4dbb8bfb51c60d0d693e9071d2c260a84.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\8f437dc4313fbd192a0d837c10e2cbc4dbb8bfb51c60d0d693e9071d2c260a84.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/956-55-0x0000000000000000-mapping.dmp

  • memory/956-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

    Filesize

    8KB

  • memory/960-54-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

    Filesize

    8KB