Analysis

  • max time kernel
    199s
  • max time network
    212s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 01:10

General

  • Target

    d88f6c6ec47e3fc96b0b00049eebf6320eea21e924fd80a9d5a10f52bbf5ce8d.dll

  • Size

    240KB

  • MD5

    f58644cb80d18cd7ab8476ba3f70413b

  • SHA1

    9796e9b668c84dd7fe189f4b45912cdf79ea0f43

  • SHA256

    d88f6c6ec47e3fc96b0b00049eebf6320eea21e924fd80a9d5a10f52bbf5ce8d

  • SHA512

    63d3b165a23724849b390e1acc366b34fc2760db56f2c919c355d900e4cce170c6d24776afb9b1d245c737ea83b6d6b8013cf53088293c9c902314696321f5cc

  • SSDEEP

    6144:/OLIL1AWurq+1QnohkHEjfryZm0FO2cEiIyU6z:/b1X+aohs+f+pFpcEPyU6

Score
1/10

Malware Config

Signatures

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d88f6c6ec47e3fc96b0b00049eebf6320eea21e924fd80a9d5a10f52bbf5ce8d.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\d88f6c6ec47e3fc96b0b00049eebf6320eea21e924fd80a9d5a10f52bbf5ce8d.dll
      2⤵
      • Modifies registry class
      PID:3476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3476-133-0x000000006DBB0000-0x000000006DBEC000-memory.dmp

    Filesize

    240KB

  • memory/3476-134-0x00000000014E0000-0x0000000001505000-memory.dmp

    Filesize

    148KB