6cb7e7dd9bc01d70df35d02643b01d2dde01676c6147bf8f287378a252cb529d | Triage

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:47

Sharing

Report Analysis Logs

General

Target

3a449530ad79602dd3221261166f6290.dll
Size

86KB
MD5

3a449530ad79602dd3221261166f6290
SHA1

3f88cb50e75381827658cec4fd39c6acbd6a32f4
SHA256

6cb7e7dd9bc01d70df35d02643b01d2dde01676c6147bf8f287378a252cb529d
SHA512

3af6416d43957c15bf41dc940198d299c0e9127055055458f2bde29f2e0279b8851e08796043b532de3bb39cd8d3f01c95398479797ddeaf3f34448506f31286
SSDEEP

1536:eX9QIwIyc6DqfpmMB5TYBOXGNMCHdr17unuqPuZg:kxwIj79T9UMCHd17uNWy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3040	1476	regsvr32.exe	28
PID 1476 wrote to memory of 3040	1476	regsvr32.exe	28
PID 1476 wrote to memory of 3040	1476	regsvr32.exe	28
PID 1476 wrote to memory of 3040	1476	regsvr32.exe	28
PID 1476 wrote to memory of 3040	1476	regsvr32.exe	28
PID 1476 wrote to memory of 3040	1476	regsvr32.exe	28
PID 1476 wrote to memory of 3040	1476	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a449530ad79602dd3221261166f6290.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3a449530ad79602dd3221261166f6290.dll
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x00000000001A0000-0x00000000001E3000-memory.dmp

Filesize
268KB

Download