17de005b6f96fc57aca7aa510b9089a5d6b17a82bd13b663ec99d1669c8e7cb5 | Triage

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 11:19

Sharing

Report Analysis Logs

General

Target

1a4d2d9e7ccf8837a777055b46747936.dll
Size

253KB
MD5

1a4d2d9e7ccf8837a777055b46747936
SHA1

232ef2cc27455d06a5bf7c9f09d8704bc22cef76
SHA256

17de005b6f96fc57aca7aa510b9089a5d6b17a82bd13b663ec99d1669c8e7cb5
SHA512

5cb2b3f8bbc88325966ea22e5cc637930d38a73dc46f6d672fe31b6c299a0420bfb0ca097da764394341174e589e757aedb2ca86fecd3e53f9c91933e41c6f1f
SSDEEP

6144:wp78nMINWDBVEASA29Fl13ATzbttb8IWZ9f9:0IN8fELsTXtmD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2328	412	regsvr32.exe	88
PID 412 wrote to memory of 2328	412	regsvr32.exe	88
PID 412 wrote to memory of 2328	412	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a4d2d9e7ccf8837a777055b46747936.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1a4d2d9e7ccf8837a777055b46747936.dll
  2⤵
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads