f00a02044311b78d54edab1469207ac125dfa68bc33c28d4b9452421bc8cbc71 | Triage

Analysis

max time kernel
144s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:39

Sharing

Report Analysis Logs

General

Target

1a3752407ee0223e94b5dfde8ba9cbee.dll
Size

120KB
MD5

1a3752407ee0223e94b5dfde8ba9cbee
SHA1

8a05c56d360dc163e972a82d5d7956283f674161
SHA256

f00a02044311b78d54edab1469207ac125dfa68bc33c28d4b9452421bc8cbc71
SHA512

7b3be9c08d339d3a737d74ae167f360b44da76b0e3ebfd90b93e672a90b62fd059f9053b3603d54e631de5a62c3dcf17803c9e42ae2c853f4d0dd7e770327d9e
SSDEEP

1536:ZhzGqSQGQ1ADAfRAFMFnc5ZpL/sxUo0qvvW4D3Ix:vQfQ19Rtmpb8U/+vW4D3O

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 860	880	regsvr32.exe	12
PID 880 wrote to memory of 860	880	regsvr32.exe	12
PID 880 wrote to memory of 860	880	regsvr32.exe	12

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1a3752407ee0223e94b5dfde8ba9cbee.dll
1⤵
PID:860

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a3752407ee0223e94b5dfde8ba9cbee.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download