b205d934150c3148b352e89367e4ef899822454d9a54cc57602b54c26bda7278 | Triage

Analysis

max time kernel
104s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/02/2023, 19:46

Sharing

Report Analysis Logs

General

Target

New Soft/msсomctll.dll
Size

1.0MB
MD5

d268668751ee22997d7ef1417034cb04
SHA1

d8a87438ab0df47fe252b06162a986399cafffe1
SHA256

fac6736251d3c61ecbd63be0420d1c75d5cd0442181d479013330155ca37d358
SHA512

75f40cc8c92e3fcdd381669f6aa0bf1e76ee6fec0c5cbf53ea0bbfbff199ac7229fc1405f737420badd24f438b49b8d2eed2bb0f3fad0bf8a974f54bd6964a34
SSDEEP

24576:TcqSrNXsCxx927qRC33KjjnZRqPnFqRo7w3zgyZdt+:TCXjx/2G9cv77EnM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1512	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1512	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1512	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1512	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1512	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1512	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1512	1696	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\New Soft\msсomctll.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\New Soft\msсomctll.dll"
  2⤵
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-56-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1696-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download