16f73fb34fae0f190c150ea6d34209852f8e7a023ce269ec082d9ef3f4375ba1 | Triage

Analysis

max time kernel
168s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:26

Sharing

Report Analysis Logs

General

Target

586km.comp222pSearcher910/dispatch.dll
Size

212KB
MD5

56a9b718949e031629637191764f7b5f
SHA1

bb8c0b210b555c3d79bc5f182c61887a0bd6441b
SHA256

170b5841536034448ab8904777d00bef9c94de0f8d750cb3002447dc9cd711d3
SHA512

feb60aaea3a028425e58c82078f9331e3f69a1daf1e1afa688865e9fb0ab0ae09c85657570d2859f16b79e453725e5c2b1c53937208db841b9b9a520255dfc95
SSDEEP

6144:O5PLvDnp+iFFotI4WqesBJRVaqLOEgU7t:O5PLLotI4WuazU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 412	4408	regsvr32.exe	87
PID 4408 wrote to memory of 412	4408	regsvr32.exe	87
PID 4408 wrote to memory of 412	4408	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\586km.comp222pSearcher910\dispatch.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\586km.comp222pSearcher910\dispatch.dll
  2⤵
  PID:412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-1-0x00000000026D0000-0x000000000274B000-memory.dmp

Filesize
492KB

Download
memory/412-0-0x0000000000B80000-0x0000000000B8E000-memory.dmp

Filesize
56KB

Download