dcac3af995d781ac884d24913f7a19d62423c8edd86bf519ee4e8fa552f10f0c | Triage

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:02

Sharing

Report Analysis Logs

General

Target

07e565f567317cdf156554c7dde49148.dll
Size

44KB
MD5

07e565f567317cdf156554c7dde49148
SHA1

d009f5626435276c3ecc1f9591d946c2fdbadbea
SHA256

dcac3af995d781ac884d24913f7a19d62423c8edd86bf519ee4e8fa552f10f0c
SHA512

928ab6af48cf9af503ca345bed60141bd75423b3a0e9924a93afd89cad09627557c8c671eafb8d8c2106be447e4481d64c70e3924d8e6f0751b5582dbfbf219a
SSDEEP

768:xoKRSrSnVwzjePNc+XZVINxwEkhrEho8bADj/:xoKRSryKHePNc+XtJhrbD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2812	1092	regsvr32.exe	29
PID 1092 wrote to memory of 2812	1092	regsvr32.exe	29
PID 1092 wrote to memory of 2812	1092	regsvr32.exe	29
PID 1092 wrote to memory of 2812	1092	regsvr32.exe	29
PID 1092 wrote to memory of 2812	1092	regsvr32.exe	29
PID 1092 wrote to memory of 2812	1092	regsvr32.exe	29
PID 1092 wrote to memory of 2812	1092	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07e565f567317cdf156554c7dde49148.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07e565f567317cdf156554c7dde49148.dll
  2⤵
  PID:2812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads