6ae7674bb269078955c6bdd193332084499885f100d2ea5717d20aeda211936a | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:45

Sharing

Report Analysis Logs

General

Target

090cdf2030b9ef66ee73159a5b7a87bb.dll
Size

139KB
MD5

090cdf2030b9ef66ee73159a5b7a87bb
SHA1

b8f0dd1bcf14bed4658614cb953727774ddc28ad
SHA256

6ae7674bb269078955c6bdd193332084499885f100d2ea5717d20aeda211936a
SHA512

a72bb7afa7977de9aace1d28b2f919956626729f9e786e0f9d70847e067a79537390e161922f6d26a5a1f33d7a11b66f4f634a51bf3aed327c2d9b4424c370e5
SSDEEP

3072:9a04dCHu3Bd4j7xbSfOiMS+7yMQYr+NtJ1oLRyGlgAH:k0bIgbA8GFYr+NtfHo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3040	4812	regsvr32.exe	90
PID 4812 wrote to memory of 3040	4812	regsvr32.exe	90
PID 4812 wrote to memory of 3040	4812	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\090cdf2030b9ef66ee73159a5b7a87bb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\090cdf2030b9ef66ee73159a5b7a87bb.dll
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads