b56b2e88ed056a6fe257838c691ed43bc6dd08fd8edc5884b0c515926f5ed00c | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 18:26

Sharing

Report Analysis Logs

General

Target

46e62f9367d5027c29ee93e28fa85bf8.dll
Size

158KB
MD5

46e62f9367d5027c29ee93e28fa85bf8
SHA1

26a6e38a1a3937317d34a5a4147899fdc7395269
SHA256

b56b2e88ed056a6fe257838c691ed43bc6dd08fd8edc5884b0c515926f5ed00c
SHA512

24e5b0f9f986c49a55bdc3af6cea26e646ef53c3ea8376b2e9b63f2e507995a08b2bf946203683e095994c6a83a05d21f0d28914531f8c9a1ea8df8159f0e4db
SSDEEP

3072:tRSJNcL/yvKEszUbt//B8xd9SQ7ykDASIG4:eDcLaYa//B6AQe8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2488	832	regsvr32.exe	28
PID 832 wrote to memory of 2488	832	regsvr32.exe	28
PID 832 wrote to memory of 2488	832	regsvr32.exe	28
PID 832 wrote to memory of 2488	832	regsvr32.exe	28
PID 832 wrote to memory of 2488	832	regsvr32.exe	28
PID 832 wrote to memory of 2488	832	regsvr32.exe	28
PID 832 wrote to memory of 2488	832	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\46e62f9367d5027c29ee93e28fa85bf8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\46e62f9367d5027c29ee93e28fa85bf8.dll
  2⤵
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download