c9ccba4c362e8aaa3348aef41e2f55e392e6a3170bdd31a28c283f7c7c05c423 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:06

Sharing

Report Analysis Logs

General

Target

0c7bf0ca9a644b4df48b1a3d45e5427e.dll
Size

29KB
MD5

0c7bf0ca9a644b4df48b1a3d45e5427e
SHA1

89323f4bc31e77b19c802fac9c85d14a1720a390
SHA256

c9ccba4c362e8aaa3348aef41e2f55e392e6a3170bdd31a28c283f7c7c05c423
SHA512

95e2253760642822925d2f1e931e778a5215a3ff92acab626bc7c2a3c8dd054c6ed33ec3cde07ec0e1396b1072670f4299e2969a399c1828258206d8f397bcaf
SSDEEP

768:TKSCquFw0GQO/mRsr5s6xMtzQXadDyTxJel:RCquFw0GQidsJQWwxW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2876	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2876	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2876	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2876	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2876	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2876	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2876	2204	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c7bf0ca9a644b4df48b1a3d45e5427e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c7bf0ca9a644b4df48b1a3d45e5427e.dll
  2⤵
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download