7013286c5cf1e11bfb98ec1f88b84cc946a659cb981bc0d576ed9d86291222db | Triage

Analysis

max time kernel
156s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fwUI.dll
Size

808KB
MD5

84ed7691eab99914c05171ca310f9465
SHA1

5c2dc6069aaeee1c98c8edc3cb4b61a63cddadd7
SHA256

7013286c5cf1e11bfb98ec1f88b84cc946a659cb981bc0d576ed9d86291222db
SHA512

a6e3feaba16fa34e03bc3cef3d5e18a6cc29cc251bc948b72b1fd423d040f10d28aa9cd69cda1e17976e39d9ab68c38d91c1d4152b4d4ed64431bb0cc8d348a7
SSDEEP

12288:bhHV6XVT1EkSW17PmOQO3MOjO/OEi2l4ywywVTvksYMVVae:UBEkSW16XpegIqwVTvksYMVVD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2592	4580	regsvr32.exe	79
PID 4580 wrote to memory of 2592	4580	regsvr32.exe	79
PID 4580 wrote to memory of 2592	4580	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fwUI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fwUI.dll
  2⤵
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads