c1a9fb299005dfe2e4bc906863c0f10cbe02d404dac4004cb91a930551d69885 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c06ad60b972302110f1942c3a239cee.dll
Size

120KB
MD5

0c06ad60b972302110f1942c3a239cee
SHA1

d04647170b62046787b3e038c008cff9df3f602a
SHA256

c1a9fb299005dfe2e4bc906863c0f10cbe02d404dac4004cb91a930551d69885
SHA512

200bc607d6475378055adcb8ef5e81c45666ac5bc26599b4e27983f2d4e232b12c1f126819f7acfb9414ef3c714e4dd39adace3fda305bb101eef14513c73c18
SSDEEP

1536:ZhqqQFDf6MmbFmWImx6Ay15WnNQYEM6ss1yi:ViDfUoDm4A5nNQ1D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2756	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2756	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2756	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2756	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2756	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2756	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2756	2896	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c06ad60b972302110f1942c3a239cee.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c06ad60b972302110f1942c3a239cee.dll
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x00000000001A0000-0x00000000001BE000-memory.dmp

Filesize
120KB

Download
memory/2756-1-0x00000000001A0000-0x00000000001BE000-memory.dmp

Filesize
120KB

Download