989e3441185193bf3682fa894500fca6887a0adea12b135d483a32c380d75d59 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 06:35

Sharing

Report Analysis Logs

General

Target

2be126c0fe0648c67dbf540564107011.dll
Size

158KB
MD5

2be126c0fe0648c67dbf540564107011
SHA1

1a13ccd9e6d6036fcfb0aab052a33b3d4132862e
SHA256

989e3441185193bf3682fa894500fca6887a0adea12b135d483a32c380d75d59
SHA512

6ced21491cea67cc633d6aa5fc82b9fcaf3d1e64592f2ad3346aefbfa23838b4ee7986db6b4e3288f8e04b029d77cfe9a2fff56b82c65f8e54406056c608a03f
SSDEEP

3072:X7p4GcIRMXPVqhDISxeA48iBFImR+Muq:rqxdueMi4mMMu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2736	2684	regsvr32.exe	28
PID 2684 wrote to memory of 2736	2684	regsvr32.exe	28
PID 2684 wrote to memory of 2736	2684	regsvr32.exe	28
PID 2684 wrote to memory of 2736	2684	regsvr32.exe	28
PID 2684 wrote to memory of 2736	2684	regsvr32.exe	28
PID 2684 wrote to memory of 2736	2684	regsvr32.exe	28
PID 2684 wrote to memory of 2736	2684	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2be126c0fe0648c67dbf540564107011.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2be126c0fe0648c67dbf540564107011.dll
  2⤵
  PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download