bd1b0f8bde46fcf7742d594e2947ab507fe4214817f499bd774c7d5a5417ddee | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:44

Sharing

Report Analysis Logs

General

Target

64b4348af47e119063a479bc0c6c2ebf.dll
Size

120KB
MD5

64b4348af47e119063a479bc0c6c2ebf
SHA1

a6ad24646a086890a37816a192debdcf587b61bd
SHA256

bd1b0f8bde46fcf7742d594e2947ab507fe4214817f499bd774c7d5a5417ddee
SHA512

b0202c14ed43108d404196a86fa2f577280cd4b543e14dd3adc3ef958eedabb45849bc71745e06966884458b99694004d70643ee1e3985a5b2656609073cbe84
SSDEEP

1536:b1qTQMq9vo7WdBO+mdfXkhYaxgmF5y4Ku41rnV:mjqtoKhHYazML

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1956	3036	regsvr32.exe	16
PID 3036 wrote to memory of 1956	3036	regsvr32.exe	16
PID 3036 wrote to memory of 1956	3036	regsvr32.exe	16
PID 3036 wrote to memory of 1956	3036	regsvr32.exe	16
PID 3036 wrote to memory of 1956	3036	regsvr32.exe	16
PID 3036 wrote to memory of 1956	3036	regsvr32.exe	16
PID 3036 wrote to memory of 1956	3036	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\64b4348af47e119063a479bc0c6c2ebf.dll
1⤵
PID:1956

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64b4348af47e119063a479bc0c6c2ebf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-0-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download
memory/1956-1-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download