6ae7674bb269078955c6bdd193332084499885f100d2ea5717d20aeda211936a | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:45

Sharing

Report Analysis Logs

General

Target

090cdf2030b9ef66ee73159a5b7a87bb.dll
Size

139KB
MD5

090cdf2030b9ef66ee73159a5b7a87bb
SHA1

b8f0dd1bcf14bed4658614cb953727774ddc28ad
SHA256

6ae7674bb269078955c6bdd193332084499885f100d2ea5717d20aeda211936a
SHA512

a72bb7afa7977de9aace1d28b2f919956626729f9e786e0f9d70847e067a79537390e161922f6d26a5a1f33d7a11b66f4f634a51bf3aed327c2d9b4424c370e5
SSDEEP

3072:9a04dCHu3Bd4j7xbSfOiMS+7yMQYr+NtJ1oLRyGlgAH:k0bIgbA8GFYr+NtfHo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1400	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1400	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1400	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1400	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1400	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1400	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1400	1876	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\090cdf2030b9ef66ee73159a5b7a87bb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\090cdf2030b9ef66ee73159a5b7a87bb.dll
  2⤵
  PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads