daac09e17db5619632a162e9a5fdada31d07f9aa12acd8b1c32fe53a00a04c1b | Triage

Analysis

max time kernel
152s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 16:09

Sharing

Report Analysis Logs

General

Target

49718e381fda9f4f6552570acf9ed84a.dll
Size

32KB
MD5

49718e381fda9f4f6552570acf9ed84a
SHA1

4c3abc97fffbe9723dd6dd6715add6f4102187f4
SHA256

daac09e17db5619632a162e9a5fdada31d07f9aa12acd8b1c32fe53a00a04c1b
SHA512

632004eb8062f481ba288297cdcdd805b333ce9716291a46b3e0f6d45d059f77f617fa5da5d3fab2dc792dc2782ad1dff134e1e12f195d3074698b0aec4d8296
SSDEEP

768:a+ThI7GgY35563FGjzFc0Ei+Qpx0wxYswx:a2hd5KcjWDi7swQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3256	2376	regsvr32.exe	89
PID 2376 wrote to memory of 3256	2376	regsvr32.exe	89
PID 2376 wrote to memory of 3256	2376	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49718e381fda9f4f6552570acf9ed84a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\49718e381fda9f4f6552570acf9ed84a.dll
  2⤵
  PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads