671ab4ed0c224dff58d17508c8949ad5f24fcdd2551eb6adecbe0eb24ceb9a62 | Triage

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 10:41

Sharing

Report Analysis Logs

General

Target

3ca31654ccd3863184b2d7819aba3a96.dll
Size

52KB
MD5

3ca31654ccd3863184b2d7819aba3a96
SHA1

544e3687d5528e27bb6525b8f1c84f55427c9601
SHA256

671ab4ed0c224dff58d17508c8949ad5f24fcdd2551eb6adecbe0eb24ceb9a62
SHA512

e8f4be4c28b84eb1888481176f732b1b9a5d26d3e602b8535427704ab91ae7ad5e172bff7f5ad489dfcf5ae32c54086d3413f36914dbe2e6c34dd71620c9d6b7
SSDEEP

768:iSACC8CRSX4fBsPQPIUOe3wuOW3k9+hHX/1M6ba:iSApnsPpUOe3wYta

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	1704	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1704	1664	regsvr32.exe	14
PID 1664 wrote to memory of 1704	1664	regsvr32.exe	14
PID 1664 wrote to memory of 1704	1664	regsvr32.exe	14
PID 1664 wrote to memory of 1704	1664	regsvr32.exe	14
PID 1664 wrote to memory of 1704	1664	regsvr32.exe	14
PID 1664 wrote to memory of 1704	1664	regsvr32.exe	14
PID 1664 wrote to memory of 1704	1664	regsvr32.exe	14
PID 1704 wrote to memory of 2748	1704	regsvr32.exe	16
PID 1704 wrote to memory of 2748	1704	regsvr32.exe	16
PID 1704 wrote to memory of 2748	1704	regsvr32.exe	16
PID 1704 wrote to memory of 2748	1704	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3ca31654ccd3863184b2d7819aba3a96.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 304
  2⤵
  - Program crash
  PID:2748

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ca31654ccd3863184b2d7819aba3a96.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1704-1-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download