1f921d74ab1afef5d9abb073dc1f1c9ab15d0c8f7050385211d91b31822ae01e | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:14

Sharing

Report Analysis Logs

General

Target

1b208a3f3bea654f8192e9589da7a26e.dll
Size

996KB
MD5

1b208a3f3bea654f8192e9589da7a26e
SHA1

b1eb1913be95aa85b5c602c1438f1876fdf010aa
SHA256

1f921d74ab1afef5d9abb073dc1f1c9ab15d0c8f7050385211d91b31822ae01e
SHA512

8982857b4936420d754b1300278ceadac404a583a8d15c7d43ed4fa0764b62838d23930762b41cb7a903092fbf56a912c4dce8ed04eb299629b1aba32c543248
SSDEEP

24576:dUdhJoWDfosizhXQcDPFP0gcQ3XSdpcbHdey4:6JjuhX/pnf3idpGG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2568	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2568	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2568	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2568	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2568	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2568	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2568	2540	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b208a3f3bea654f8192e9589da7a26e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b208a3f3bea654f8192e9589da7a26e.dll
  2⤵
  PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-0-0x00000000001D0000-0x0000000000273000-memory.dmp

Filesize
652KB

Download