daac09e17db5619632a162e9a5fdada31d07f9aa12acd8b1c32fe53a00a04c1b | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 16:09

Sharing

Report Analysis Logs

General

Target

49718e381fda9f4f6552570acf9ed84a.dll
Size

32KB
MD5

49718e381fda9f4f6552570acf9ed84a
SHA1

4c3abc97fffbe9723dd6dd6715add6f4102187f4
SHA256

daac09e17db5619632a162e9a5fdada31d07f9aa12acd8b1c32fe53a00a04c1b
SHA512

632004eb8062f481ba288297cdcdd805b333ce9716291a46b3e0f6d45d059f77f617fa5da5d3fab2dc792dc2782ad1dff134e1e12f195d3074698b0aec4d8296
SSDEEP

768:a+ThI7GgY35563FGjzFc0Ei+Qpx0wxYswx:a2hd5KcjWDi7swQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2952	2904	regsvr32.exe	28
PID 2904 wrote to memory of 2952	2904	regsvr32.exe	28
PID 2904 wrote to memory of 2952	2904	regsvr32.exe	28
PID 2904 wrote to memory of 2952	2904	regsvr32.exe	28
PID 2904 wrote to memory of 2952	2904	regsvr32.exe	28
PID 2904 wrote to memory of 2952	2904	regsvr32.exe	28
PID 2904 wrote to memory of 2952	2904	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49718e381fda9f4f6552570acf9ed84a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\49718e381fda9f4f6552570acf9ed84a.dll
  2⤵
  PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download