0b4b10a07723f1c81cae1cb69ec8196c6f1222ffd324f7b4f52d19e516001b9a | Triage

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:51

Sharing

Report Analysis Logs

General

Target

07934353596a31503ff5b9c6b51bbaff.dll
Size

97KB
MD5

07934353596a31503ff5b9c6b51bbaff
SHA1

7dca0fd56fb8a09591f6f5c5742de8bfbed26b23
SHA256

0b4b10a07723f1c81cae1cb69ec8196c6f1222ffd324f7b4f52d19e516001b9a
SHA512

308dcbdd5801160f59aceb5c45f7e46eaddde16793eb6832cf1d785c6aff877bfef8987a4cb6c043f93a4c76ee65556dfe8ba9c2d28d24e9cb39bbf759f0b953
SSDEEP

3072:RfIyLKlDkUoPsfIyLKlDkUoPsfIyLKlDkUoP:RfIVJ5oPsfIVJ5oPsfIVJ5oP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 4960	2148	regsvr32.exe	15
PID 2148 wrote to memory of 4960	2148	regsvr32.exe	15
PID 2148 wrote to memory of 4960	2148	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07934353596a31503ff5b9c6b51bbaff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07934353596a31503ff5b9c6b51bbaff.dll
  2⤵
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads