911d1ba4cbe7624b5a09911754f6ff1c7003afc066c627791c35ff257451ab14 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46d7ae897601390112ff667c6e6d1e5e.dll
Size

220KB
MD5

46d7ae897601390112ff667c6e6d1e5e
SHA1

3c762461c32254e14839b31a23470f9c283bcd0e
SHA256

911d1ba4cbe7624b5a09911754f6ff1c7003afc066c627791c35ff257451ab14
SHA512

719c1b26edd202bc18376fe20fa47f933ea1c9a897fa5901abfc162c8c2edd26e285ea4e299b7aab0bde1fb0963794f482254c1eef8ae03a0d9363f61fa9d278
SSDEEP

3072:yvl1hGvl1hGvl1hGvl1hGvl1hGvl1hGvl1h:yv7cv7cv7cv7cv7cv7cv7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2704	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2704	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2704	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2704	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2704	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2704	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2704	2756	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\46d7ae897601390112ff667c6e6d1e5e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\46d7ae897601390112ff667c6e6d1e5e.dll
  2⤵
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-0-0x00000000001F0000-0x00000000001FD000-memory.dmp

Filesize
52KB

Download