d4720fbadd18ebce1c854925d8bc71d6772f9855773b7fa5260f1817a19bad21 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:52

Sharing

Report Analysis Logs

General

Target

03b066246003814bde75b991b45208c8.dll
Size

99KB
MD5

03b066246003814bde75b991b45208c8
SHA1

cc68211c3f5db2c23d2f54433f41a18e22bcbc6c
SHA256

d4720fbadd18ebce1c854925d8bc71d6772f9855773b7fa5260f1817a19bad21
SHA512

1e62b4493f45cc1bba947f850f18f9fa6460267ea130082a3216437200126eec8343385e88afaccd53ab53eac1e3276c5994f56ad29d89d2e944cbd70c755f03
SSDEEP

3072:/501wxblRZ/RVXVdMvxFQLvHvtiW2MSK:/9xjxbMxWLvHc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1652	1404	regsvr32.exe	16
PID 1404 wrote to memory of 1652	1404	regsvr32.exe	16
PID 1404 wrote to memory of 1652	1404	regsvr32.exe	16
PID 1404 wrote to memory of 1652	1404	regsvr32.exe	16
PID 1404 wrote to memory of 1652	1404	regsvr32.exe	16
PID 1404 wrote to memory of 1652	1404	regsvr32.exe	16
PID 1404 wrote to memory of 1652	1404	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\03b066246003814bde75b991b45208c8.dll
1⤵
PID:1652

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\03b066246003814bde75b991b45208c8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-0-0x0000000000280000-0x00000000002C7000-memory.dmp

Filesize
284KB

Download