a9d31704dfd9096d3b112499576573ef5aa4e9d5f70c5a9471dc0c32f51d0532 | Triage

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 02:20

Sharing

Report Analysis Logs

General

Target

3ba4249a16facf6fd1c74bda67c5f467.dll
Size

206KB
MD5

3ba4249a16facf6fd1c74bda67c5f467
SHA1

d5e10f676738d648e6f08f92a05b5293e02e35d9
SHA256

a9d31704dfd9096d3b112499576573ef5aa4e9d5f70c5a9471dc0c32f51d0532
SHA512

bda57482c88e310f3370a9a23ad1a29ed6f197dae756c6e13e6ac7ddfc382048c099e9c835d59015f5b08f8c54ef1a28e79ef52dfb67c0d42ebcb0160cb910ce
SSDEEP

3072:urR8EjrR8EjrR8EjrR8EjrR8EjrR8EjrR8E:urmmrmmrmmrmmrmmrmmrm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3968	3340	regsvr32.exe	12
PID 3340 wrote to memory of 3968	3340	regsvr32.exe	12
PID 3340 wrote to memory of 3968	3340	regsvr32.exe	12

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3ba4249a16facf6fd1c74bda67c5f467.dll
1⤵
PID:3968

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ba4249a16facf6fd1c74bda67c5f467.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads