2de49294af1c1cea5c44dfa2a5df2703bd5ad4358ea4d53ffdfd39528eb665f0 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:56

Sharing

Report Analysis Logs

General

Target

290da7c39fd92dec95c308dafee61f71.dll
Size

33KB
MD5

290da7c39fd92dec95c308dafee61f71
SHA1

13473a9d661acddb213cd78d28ca125bac3e50c3
SHA256

2de49294af1c1cea5c44dfa2a5df2703bd5ad4358ea4d53ffdfd39528eb665f0
SHA512

a27e8aba1427da26e89eb1fb25ec872d691e6c85bc49d2e9509a36bfd3e5bbe5e1ec53720fba37f306c0ef4ac4e99bec78f3c0df2b301fd61d6b9b2ce94fc8eb
SSDEEP

768:UsoihqZOmVQLNSlI1k5dueUux6C3fJtu2BjG:UsvhqZxVQLtU/Uu4C3fq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2988	2916	regsvr32.exe	16
PID 2916 wrote to memory of 2988	2916	regsvr32.exe	16
PID 2916 wrote to memory of 2988	2916	regsvr32.exe	16
PID 2916 wrote to memory of 2988	2916	regsvr32.exe	16
PID 2916 wrote to memory of 2988	2916	regsvr32.exe	16
PID 2916 wrote to memory of 2988	2916	regsvr32.exe	16
PID 2916 wrote to memory of 2988	2916	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\290da7c39fd92dec95c308dafee61f71.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\290da7c39fd92dec95c308dafee61f71.dll
  2⤵
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads