30e9d6da81c87ab58d9575188664de49b2c434f6b1346a2a5033b49992254464 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 02:59

Sharing

Report Analysis Logs

General

Target

payload.dll
Size

300.0MB
MD5

3ba404b551a241dfb984735c87622741
SHA1

1b2a4cbdacf4f33c8f863d557744bb18ba8485f6
SHA256

b4717d4c65dc8d69d33ac0dc7d3f7608637a420cd3454f4eec0a2238d83327d4
SHA512

3ec6d0ab748c0920d42def7e722847fefc6466142f8221589d14111311726ceb015f0ef60bb4bc8b086f5e6cd5073e6c8a2fb4f8dd8003121c5216a944430b21
SSDEEP

6144:iA+z1A+PNVjAyk6GEmmF/aKCH+MuzMy4:mAGkbFt+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2596	3012	regsvr32.exe	29
PID 3012 wrote to memory of 2596	3012	regsvr32.exe	29
PID 3012 wrote to memory of 2596	3012	regsvr32.exe	29
PID 3012 wrote to memory of 2648	3012	regsvr32.exe	30
PID 3012 wrote to memory of 2648	3012	regsvr32.exe	30
PID 3012 wrote to memory of 2648	3012	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\payload.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3012 -s 292
  2⤵
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads