c4923cd0534a46278c8467c3e6cb139ae44fb8a0d3b3e567bf80dad94ad605e7 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ISSetup.dll
Size

773KB
MD5

a17a7931b3524d05253c5aa3d06fd364
SHA1

f8fdbf930d7d4178f464c0e5f9dc3ae510760747
SHA256

36a641a6639d6e64bba621ef1b7c1ec69be52a53a9168be2a8a50ee1c0394e8c
SHA512

32aba57d57b1d664aa9023ed249a59c797f92ec4a966de7499f91f05f9b0242ccc75b44dc7ef9d3962bc7d7232fc7f30a95ce890f4ac41b369c6252b117849a8
SSDEEP

12288:ju4+8dmpdCVCkg2jLX5aCRIOMK9Ji0BHY5MqZ9BpD1CsXyibT9JHW:juegpcVCgjr5aCBHH69RCG72

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3044	2244	regsvr32.exe	28
PID 2244 wrote to memory of 3044	2244	regsvr32.exe	28
PID 2244 wrote to memory of 3044	2244	regsvr32.exe	28
PID 2244 wrote to memory of 3044	2244	regsvr32.exe	28
PID 2244 wrote to memory of 3044	2244	regsvr32.exe	28
PID 2244 wrote to memory of 3044	2244	regsvr32.exe	28
PID 2244 wrote to memory of 3044	2244	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ISSetup.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ISSetup.dll
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000010000000-0x0000000010257000-memory.dmp

Filesize
2.3MB

Download
memory/3044-1-0x00000000000D0000-0x00000000000D2000-memory.dmp

Filesize
8KB

Download