5439154c2e5e7bc8c6e489e61262ca0e093c53c1a7342dcc4e4a6374806e0f6b | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:30

Sharing

Report Analysis Logs

General

Target

5fed6781bf81b90e0753bfaa2c1a3b33.dll
Size

544KB
MD5

5fed6781bf81b90e0753bfaa2c1a3b33
SHA1

0c4a68c0b9bf0d2a6c6e83bce4186a4237b923b1
SHA256

5439154c2e5e7bc8c6e489e61262ca0e093c53c1a7342dcc4e4a6374806e0f6b
SHA512

149a0ecd80f2af0f095098ddb1babac7b969eba11041426732036c55c46b6da168a1f124975408f7b5d3f2c17fb062dc5f0666f8f045ee1587b1f9e7e00b4986
SSDEEP

12288:g+uNFRWB7/FvyXZI37AcmgixknF8c0orNd:jAIdvyXZI37AcmzknKcdrD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1752	1688	regsvr32.exe	16
PID 1688 wrote to memory of 1752	1688	regsvr32.exe	16
PID 1688 wrote to memory of 1752	1688	regsvr32.exe	16
PID 1688 wrote to memory of 1752	1688	regsvr32.exe	16
PID 1688 wrote to memory of 1752	1688	regsvr32.exe	16
PID 1688 wrote to memory of 1752	1688	regsvr32.exe	16
PID 1688 wrote to memory of 1752	1688	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fed6781bf81b90e0753bfaa2c1a3b33.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5fed6781bf81b90e0753bfaa2c1a3b33.dll
  2⤵
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads