cbe5cdf7ad6e2c7b436b15be3f500205a5d62d9fe07f7744171a19e1486a176f | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:19

Sharing

Report Analysis Logs

General

Target

olepro32.dll
Size

104KB
MD5

2d17cf9d158c8a64f5e5eb6a4142ad8e
SHA1

8a53b7431046bde97e64a3ee8259d970525c59e2
SHA256

9fb729dbee012aba4c3541c4b9fcd6a1b6a47b67eb760cf5069b1ca5bf66666b
SHA512

e3fb223f2ef5a00d7eb639a67a741a6225ae08178828ad751c32ecb64641768ff7f1874ad24272109e9b5fc065089bc05da0d280241dbb0e9ce0ca4c2d52c9a4
SSDEEP

1536:D+HE0wZ7LhXlqBpwiyzTEiYHoyjs4N4xwPyrIM750tMWVQ6A7:6HZwZ7tsBLsT6BNt6sM750Y6i

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2928	2924	regsvr32.exe	16
PID 2924 wrote to memory of 2928	2924	regsvr32.exe	16
PID 2924 wrote to memory of 2928	2924	regsvr32.exe	16
PID 2924 wrote to memory of 2928	2924	regsvr32.exe	16
PID 2924 wrote to memory of 2928	2924	regsvr32.exe	16
PID 2924 wrote to memory of 2928	2924	regsvr32.exe	16
PID 2924 wrote to memory of 2928	2924	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\olepro32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\olepro32.dll
  2⤵
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads