cf34427a303353d6427f22a6f0c8ae2e3e99e4d172d2207568133a2df7e6f4de | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 14:56

Sharing

Report Analysis Logs

General

Target

77454009373782291cfd99bfc3d69234.dll
Size

14KB
MD5

77454009373782291cfd99bfc3d69234
SHA1

342f5d08d0c1cfd9cabfa24927e927153b7df454
SHA256

cf34427a303353d6427f22a6f0c8ae2e3e99e4d172d2207568133a2df7e6f4de
SHA512

7226e67b96ee671aef57c72a958eb974fda3f782e9393ccd464aa5d77365c18c1437a1dafb7fbafecd35b88a2fadecc32897d15c9a4d583f5f3bb166842446f9
SSDEEP

384:p9JNv8xgaywAnRWyMFKfuhi9qJg0mmCFcy:zXv8xewAnfMFnIcFEuy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3020	2904	regsvr32.exe	28
PID 2904 wrote to memory of 3020	2904	regsvr32.exe	28
PID 2904 wrote to memory of 3020	2904	regsvr32.exe	28
PID 2904 wrote to memory of 3020	2904	regsvr32.exe	28
PID 2904 wrote to memory of 3020	2904	regsvr32.exe	28
PID 2904 wrote to memory of 3020	2904	regsvr32.exe	28
PID 2904 wrote to memory of 3020	2904	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\77454009373782291cfd99bfc3d69234.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\77454009373782291cfd99bfc3d69234.dll
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads