5dec392556ef6a4fd914ce29eef702eb3481597dee06f1d0ac7612ea8283f379 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 01:48

Sharing

Report Analysis Logs

General

Target

4a6f77e708403fb6995e5fa2a90343c4.dll
Size

212KB
MD5

4a6f77e708403fb6995e5fa2a90343c4
SHA1

e6c8383facaba5ae01bf44d08c911340561f2438
SHA256

5dec392556ef6a4fd914ce29eef702eb3481597dee06f1d0ac7612ea8283f379
SHA512

84c80c07a5ea47968aabe3468e665a079823621a4e08e03e63e114e978151d929b63b2be7bf9ea59581cb4ceb734e40177426d572151cae0121fa388f2b72643
SSDEEP

6144:Cgx6PUpzculsk7BPXS5Es2ATbwigxzr4Z:C4pzllhaEbAAV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 5004	3208	regsvr32.exe	88
PID 3208 wrote to memory of 5004	3208	regsvr32.exe	88
PID 3208 wrote to memory of 5004	3208	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a6f77e708403fb6995e5fa2a90343c4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4a6f77e708403fb6995e5fa2a90343c4.dll
  2⤵
  PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5004-0-0x0000000004190000-0x00000000041D9000-memory.dmp

Filesize
292KB

Download