484bb4f6eba3b59090f78accf411dd6683acabb7716cf439a3b3e94f3aea2d8b | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:06

Sharing

Report Analysis Logs

General

Target

1df99b662803b27b9714d7d71ca40cba.dll
Size

29KB
MD5

1df99b662803b27b9714d7d71ca40cba
SHA1

3e0ce02db4fd6cc2983529d16a3bda8440785c4b
SHA256

484bb4f6eba3b59090f78accf411dd6683acabb7716cf439a3b3e94f3aea2d8b
SHA512

fd395cafba219795a6b0af32f6fed4076a705917bed2a7a6bedcd1038ba3c58271e07d10a17d202b3cbed1d3b1305184cca34157ec456782a5baeaf171877c6a
SSDEEP

768:XKSUquI80GQsWegUGpDrlyo/2CWtcz479ZQ6:tUquI80GQpUGtrlHctczG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1708	1216	regsvr32.exe	16
PID 1216 wrote to memory of 1708	1216	regsvr32.exe	16
PID 1216 wrote to memory of 1708	1216	regsvr32.exe	16
PID 1216 wrote to memory of 1708	1216	regsvr32.exe	16
PID 1216 wrote to memory of 1708	1216	regsvr32.exe	16
PID 1216 wrote to memory of 1708	1216	regsvr32.exe	16
PID 1216 wrote to memory of 1708	1216	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1df99b662803b27b9714d7d71ca40cba.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1df99b662803b27b9714d7d71ca40cba.dll
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download