5439154c2e5e7bc8c6e489e61262ca0e093c53c1a7342dcc4e4a6374806e0f6b | Triage

Analysis

max time kernel
142s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:30

Sharing

Report Analysis Logs

General

Target

5fed6781bf81b90e0753bfaa2c1a3b33.dll
Size

544KB
MD5

5fed6781bf81b90e0753bfaa2c1a3b33
SHA1

0c4a68c0b9bf0d2a6c6e83bce4186a4237b923b1
SHA256

5439154c2e5e7bc8c6e489e61262ca0e093c53c1a7342dcc4e4a6374806e0f6b
SHA512

149a0ecd80f2af0f095098ddb1babac7b969eba11041426732036c55c46b6da168a1f124975408f7b5d3f2c17fb062dc5f0666f8f045ee1587b1f9e7e00b4986
SSDEEP

12288:g+uNFRWB7/FvyXZI37AcmgixknF8c0orNd:jAIdvyXZI37AcmzknKcdrD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4856	2956	regsvr32.exe	90
PID 2956 wrote to memory of 4856	2956	regsvr32.exe	90
PID 2956 wrote to memory of 4856	2956	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fed6781bf81b90e0753bfaa2c1a3b33.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5fed6781bf81b90e0753bfaa2c1a3b33.dll
  2⤵
  PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads