16f73fb34fae0f190c150ea6d34209852f8e7a023ce269ec082d9ef3f4375ba1 | Triage

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:26

Sharing

Report Analysis Logs

General

Target

586km.comp222pSearcher910/kads.dll
Size

916KB
MD5

cb63c2da5c9a0ff071fae6f3c941962c
SHA1

69eba718b853c1be78db84606affe527c07071f3
SHA256

b9ff8da7db9dd71e57a162c7ec51e36ce3cd2777c740bac98231a75ae9fbbfc6
SHA512

4f6c577635f24968c47499b7228b1d558c9fb21e64756b784db320d71ba39c654d48b24c3d499c149de2da94edef1ae08d037a0e0bdd926c0bbf39c8bfddeb28
SSDEEP

24576:cvBtk1ERCrQ5MQsOL5yka67RWk62tKQWQ2O:c5oEUs5MQsOL7z62tKA1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4632	1564	regsvr32.exe	91
PID 1564 wrote to memory of 4632	1564	regsvr32.exe	91
PID 1564 wrote to memory of 4632	1564	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\586km.comp222pSearcher910\kads.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\586km.comp222pSearcher910\kads.dll
  2⤵
  PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads