a9d31704dfd9096d3b112499576573ef5aa4e9d5f70c5a9471dc0c32f51d0532 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:20

Sharing

Report Analysis Logs

General

Target

3ba4249a16facf6fd1c74bda67c5f467.dll
Size

206KB
MD5

3ba4249a16facf6fd1c74bda67c5f467
SHA1

d5e10f676738d648e6f08f92a05b5293e02e35d9
SHA256

a9d31704dfd9096d3b112499576573ef5aa4e9d5f70c5a9471dc0c32f51d0532
SHA512

bda57482c88e310f3370a9a23ad1a29ed6f197dae756c6e13e6ac7ddfc382048c099e9c835d59015f5b08f8c54ef1a28e79ef52dfb67c0d42ebcb0160cb910ce
SSDEEP

3072:urR8EjrR8EjrR8EjrR8EjrR8EjrR8EjrR8E:urmmrmmrmmrmmrmmrmmrm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ba4249a16facf6fd1c74bda67c5f467.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3ba4249a16facf6fd1c74bda67c5f467.dll
  2⤵
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download