c188c2c81fa2ec16e738f7e9200c5f6eddb28c65ee002d80761022baf253c8f6 | Triage

Analysis

max time kernel
155s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 04:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55304e6ba0fbaed83c16ad8b4546f040.dll
Size

120KB
MD5

55304e6ba0fbaed83c16ad8b4546f040
SHA1

6f4785fe0e5474c48f4c87ef5ebc6c55fe8525c9
SHA256

c188c2c81fa2ec16e738f7e9200c5f6eddb28c65ee002d80761022baf253c8f6
SHA512

3d9f3dae3d7b44d80f53803b9a30cc2abc08521e540bfe0a0e6ae2ab579d2596dd08af1603ff94d51b0d3c38b5d16fa4719ed47684b1a0147ed8bd549eec4a32
SSDEEP

1536:ZhzGqSQGQ1ADAfRAFMFnc5ZpL/sxUo0qvvW4D3IB:vQfQ19Rtmpb8U/+vW4D3i

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2992	4836	regsvr32.exe	91
PID 4836 wrote to memory of 2992	4836	regsvr32.exe	91
PID 4836 wrote to memory of 2992	4836	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\55304e6ba0fbaed83c16ad8b4546f040.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\55304e6ba0fbaed83c16ad8b4546f040.dll
  2⤵
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download