8eb2ba793c547d20b074e35818f25afb491439e4942c7bdba8151560442af0a4 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:31

Sharing

Report Analysis Logs

General

Target

2013b0dec0fe003e1815f71cc0c9b389.dll
Size

12KB
MD5

2013b0dec0fe003e1815f71cc0c9b389
SHA1

02e832670c1b0aa1e62022c7b268fd9e643bb5c4
SHA256

8eb2ba793c547d20b074e35818f25afb491439e4942c7bdba8151560442af0a4
SHA512

f0ff7b1935570cc125ba86414896a44d3668bfa6b4dfa0498e8e89ed63156e1420b41937a0bbbd65e722eab0e39570d8dd1dd8830dc5e21408a49022de4efc3f
SSDEEP

192:+MwEsdomsx4diyx1V5/A5XgA8MAl7Gv8hPCw9hd5M8DUR:+MwEAZH/OgzCiYR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2204	2180	regsvr32.exe	17
PID 2180 wrote to memory of 2204	2180	regsvr32.exe	17
PID 2180 wrote to memory of 2204	2180	regsvr32.exe	17
PID 2180 wrote to memory of 2204	2180	regsvr32.exe	17
PID 2180 wrote to memory of 2204	2180	regsvr32.exe	17
PID 2180 wrote to memory of 2204	2180	regsvr32.exe	17
PID 2180 wrote to memory of 2204	2180	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2013b0dec0fe003e1815f71cc0c9b389.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2013b0dec0fe003e1815f71cc0c9b389.dll
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads