Analysis
-
max time kernel
27s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 06:48
Static task
static1
Behavioral task
behavioral1
Sample
f9c1c66b78402910e3fb2c448245d5be45a0ee5019e33564c5c55b2ec948ac8b.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f9c1c66b78402910e3fb2c448245d5be45a0ee5019e33564c5c55b2ec948ac8b.dll
Resource
win10v2004-20221111-en
General
-
Target
f9c1c66b78402910e3fb2c448245d5be45a0ee5019e33564c5c55b2ec948ac8b.dll
-
Size
2.4MB
-
MD5
d28b9e02b9cef4d57ba7fb5ea5495e7f
-
SHA1
54aecb98b7ca76c217c605fa95f8bf59781857a0
-
SHA256
f9c1c66b78402910e3fb2c448245d5be45a0ee5019e33564c5c55b2ec948ac8b
-
SHA512
426d35682cc15419ba2d37167455522071a3d8b8efe2de60dea6ac56e67c071ef83e1702d369480b7dd028c6af2794f0cca841480a15456918796ec730680267
-
SSDEEP
49152:qWlitqo5Z23BYMFILjZnyKR5R0P+aW/JH1Q/G6omDmPnT8i3:qTqAnhRM+aiMHoSkA2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2024 wrote to memory of 1788 2024 regsvr32.exe regsvr32.exe PID 2024 wrote to memory of 1788 2024 regsvr32.exe regsvr32.exe PID 2024 wrote to memory of 1788 2024 regsvr32.exe regsvr32.exe PID 2024 wrote to memory of 1788 2024 regsvr32.exe regsvr32.exe PID 2024 wrote to memory of 1788 2024 regsvr32.exe regsvr32.exe PID 2024 wrote to memory of 1788 2024 regsvr32.exe regsvr32.exe PID 2024 wrote to memory of 1788 2024 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f9c1c66b78402910e3fb2c448245d5be45a0ee5019e33564c5c55b2ec948ac8b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f9c1c66b78402910e3fb2c448245d5be45a0ee5019e33564c5c55b2ec948ac8b.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1788-55-0x0000000000000000-mapping.dmp
-
memory/1788-56-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/1788-57-0x0000000000BA0000-0x0000000000D38000-memory.dmpFilesize
1.6MB
-
memory/1788-58-0x0000000000BA0000-0x0000000000D38000-memory.dmpFilesize
1.6MB
-
memory/2024-54-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmpFilesize
8KB