4ad4b1410ed957d39985d24c613036f2b777dd2ed01a3ae7a9ab28e298f29ede | Triage

Resubmissions

09-02-2023 09:04

230209-k1zyqsdc3w 9

09-02-2023 08:58

230209-kxfexsda4t 9

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-02-2023 08:58

Sharing

Report Analysis Logs

General

Target

00gif.dll
Size

171KB
MD5

60827386e2d158fb3c2dff6ef19a6a3e
SHA1

7f687e70c319d419b91c85b4c8a027cae2876714
SHA256

4ad4b1410ed957d39985d24c613036f2b777dd2ed01a3ae7a9ab28e298f29ede
SHA512

a1a612af39d410ad6c5d17b016d8c0c9b4436203cc57616b436b18e40b715a4e80ab9b5419b4229b92a2a70e755a8eb41c8bda424fa503dc06ba5951f50a0bcc
SSDEEP

3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00gif.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00gif.dll
  2⤵
  PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-56-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1492-54-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download