19e0105d47a310fc0a3eb585eb07ee93785dc4404d2646fe472eaf01151d898e | Triage

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:58

Sharing

Report Analysis Logs

General

Target

277d115bcd2dc3db13377371b6e2195b.dll
Size

221KB
MD5

277d115bcd2dc3db13377371b6e2195b
SHA1

5572edab26b2005ccab184a81172662c89c70a86
SHA256

19e0105d47a310fc0a3eb585eb07ee93785dc4404d2646fe472eaf01151d898e
SHA512

9af934c10eb5c46fbadaa74d0d46bb50c3e02ec9c0f5b139b31ab2c254d6c76a6a3c23e25d47be12ffede0f95f90357959b6919176a0f9373d5f3f87db8f9c51
SSDEEP

6144:Tj2aLHLEbfdFpwPMHL8VjzKFc/OgEzGlDJ1r3:TVLr8drw4L8B2DgEeN1r3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1788	2280	regsvr32.exe	87
PID 2280 wrote to memory of 1788	2280	regsvr32.exe	87
PID 2280 wrote to memory of 1788	2280	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\277d115bcd2dc3db13377371b6e2195b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\277d115bcd2dc3db13377371b6e2195b.dll
  2⤵
  PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads