1ab1264092957d906ad993c4311433c9042f3f36015ef02b3710f0d6d90938ea | Triage

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:42

Sharing

Report Analysis Logs

General

Target

3c1b8478edc3efaebe7287ec90d0656f.dll
Size

130KB
MD5

3c1b8478edc3efaebe7287ec90d0656f
SHA1

d7593f76d35d87e63ea79c11f3d3d37ea649d69d
SHA256

1ab1264092957d906ad993c4311433c9042f3f36015ef02b3710f0d6d90938ea
SHA512

2e4661e4b013c92be85fa5cf0a032c7f07b6daca8c59cd7195f8b13b36e840810f03fa3d518c3687933c79e604b85ab0e656725b8dae07a20c9f28b4b40eab39
SSDEEP

1536:Jkf0xg0Ius6kf0xg0Ius6kf0xg0Ius6kf0xg0Ius:Phtsqhtsqhtsqhts

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2308	836	regsvr32.exe	28
PID 836 wrote to memory of 2308	836	regsvr32.exe	28
PID 836 wrote to memory of 2308	836	regsvr32.exe	28
PID 836 wrote to memory of 2308	836	regsvr32.exe	28
PID 836 wrote to memory of 2308	836	regsvr32.exe	28
PID 836 wrote to memory of 2308	836	regsvr32.exe	28
PID 836 wrote to memory of 2308	836	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c1b8478edc3efaebe7287ec90d0656f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3c1b8478edc3efaebe7287ec90d0656f.dll
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download