9f8d31b076fc7040f8f8569557e9caba3acdeff97e06835e07d4ca3679238e80 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 09:51

Sharing

Report Analysis Logs

General

Target

650fcbe93292ffc37d3f5204cc40eef7.dll
Size

120KB
MD5

650fcbe93292ffc37d3f5204cc40eef7
SHA1

e01067d7c7c0589a728f2eaaecc77ef76ee8d408
SHA256

9f8d31b076fc7040f8f8569557e9caba3acdeff97e06835e07d4ca3679238e80
SHA512

83eb99adc725f93a36b779638a12c7fa186a4d83aa83c16eec673e1f03b928a1cbe553638ca68a273b2defe14b794198597643583d3b0437b283123a2d9b9d46
SSDEEP

1536:tNqMQlu4XMKTwjaDKj+VeK6TV6P19UCRg1gOVAa:bmu4jTwj1JKMGgCRgaa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2312	2888	regsvr32.exe	28
PID 2888 wrote to memory of 2312	2888	regsvr32.exe	28
PID 2888 wrote to memory of 2312	2888	regsvr32.exe	28
PID 2888 wrote to memory of 2312	2888	regsvr32.exe	28
PID 2888 wrote to memory of 2312	2888	regsvr32.exe	28
PID 2888 wrote to memory of 2312	2888	regsvr32.exe	28
PID 2888 wrote to memory of 2312	2888	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\650fcbe93292ffc37d3f5204cc40eef7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\650fcbe93292ffc37d3f5204cc40eef7.dll
  2⤵
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-0-0x0000000000150000-0x000000000016E000-memory.dmp

Filesize
120KB

Download
memory/2312-1-0x0000000000150000-0x000000000016E000-memory.dmp

Filesize
120KB

Download