Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 17:51
Behavioral task
behavioral1
Sample
b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc.dll
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
General
-
Target
b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc.dll
-
Size
205KB
-
MD5
57e457058c8d921f5a6331b604ed53d2
-
SHA1
87fbe909120fb3cdaa8f7156d0eb13daaf398c18
-
SHA256
b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc
-
SHA512
6e7de1eeaef54b7ec0117d8420d55ecc0a36ebb28f6ed598d1e265610e7f2e600d5c9688c2a048f41498368c3c09ffc5cf7bf36989f96270fa6367eb4377feba
-
SSDEEP
6144:r5VztJgfZzCBQM/+DLLidZtJfNkeZ74mE:r3zrQzCBQbPLu9fN4Z
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1088 wrote to memory of 1072 1088 regsvr32.exe regsvr32.exe PID 1088 wrote to memory of 1072 1088 regsvr32.exe regsvr32.exe PID 1088 wrote to memory of 1072 1088 regsvr32.exe regsvr32.exe PID 1088 wrote to memory of 1072 1088 regsvr32.exe regsvr32.exe PID 1088 wrote to memory of 1072 1088 regsvr32.exe regsvr32.exe PID 1088 wrote to memory of 1072 1088 regsvr32.exe regsvr32.exe PID 1088 wrote to memory of 1072 1088 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1072-55-0x0000000000000000-mapping.dmp
-
memory/1072-56-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1072-57-0x0000000000240000-0x0000000000283000-memory.dmpFilesize
268KB
-
memory/1088-54-0x000007FEFB761000-0x000007FEFB763000-memory.dmpFilesize
8KB