8d1048fed38e75f78d68750772eb632ccca15251dc8bd0a24981516f3d154717 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 22:18

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Razy.969857.25186.6155.dll
Size

1.6MB
MD5

d9649126e11df5526521f6ae38f076c4
SHA1

1c6a9f4df126580007d813d06ec0efc908351996
SHA256

8d1048fed38e75f78d68750772eb632ccca15251dc8bd0a24981516f3d154717
SHA512

c4e2122ca03ce2b45a6f932d2b659c6d9501a7afdbad3559c04df3a9f86048b78024aa9ac04c63f1320cdaa86f5c3d8bd649c9091f23288d46c17d807acc3df1
SSDEEP

49152:QVlf4p3BCLj5f8TCOtTj8ah9e2bt28nQ:V2Lj58Rr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3048	2980	regsvr32.exe	28
PID 2980 wrote to memory of 3048	2980	regsvr32.exe	28
PID 2980 wrote to memory of 3048	2980	regsvr32.exe	28
PID 2980 wrote to memory of 3048	2980	regsvr32.exe	28
PID 2980 wrote to memory of 3048	2980	regsvr32.exe	28
PID 2980 wrote to memory of 3048	2980	regsvr32.exe	28
PID 2980 wrote to memory of 3048	2980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.969857.25186.6155.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.969857.25186.6155.dll
  2⤵
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads