c4923cd0534a46278c8467c3e6cb139ae44fb8a0d3b3e567bf80dad94ad605e7 | Triage

Analysis

max time kernel
155s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 00:33

Sharing

Report Analysis Logs

General

Target

ISSetup.dll
Size

773KB
MD5

a17a7931b3524d05253c5aa3d06fd364
SHA1

f8fdbf930d7d4178f464c0e5f9dc3ae510760747
SHA256

36a641a6639d6e64bba621ef1b7c1ec69be52a53a9168be2a8a50ee1c0394e8c
SHA512

32aba57d57b1d664aa9023ed249a59c797f92ec4a966de7499f91f05f9b0242ccc75b44dc7ef9d3962bc7d7232fc7f30a95ce890f4ac41b369c6252b117849a8
SSDEEP

12288:ju4+8dmpdCVCkg2jLX5aCRIOMK9Ji0BHY5MqZ9BpD1CsXyibT9JHW:juegpcVCgjr5aCBHH69RCG72

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4448	4896	regsvr32.exe	87
PID 4896 wrote to memory of 4448	4896	regsvr32.exe	87
PID 4896 wrote to memory of 4448	4896	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ISSetup.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ISSetup.dll
  2⤵
  PID:4448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-0-0x0000000010000000-0x0000000010257000-memory.dmp

Filesize
2.3MB

Download
memory/4448-1-0x0000000000EC0000-0x0000000000EC2000-memory.dmp

Filesize
8KB

Download