ab558610c921655b4c5533175b9c55c8798b578fd87ca0d7047d22ec9669b250 | Triage

Analysis

max time kernel
146s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 00:46

Sharing

Report Analysis Logs

General

Target

4a3784752f28a3b6a4d822c25386c73e.dll
Size

117KB
MD5

4a3784752f28a3b6a4d822c25386c73e
SHA1

c265c48f7090bfbda0a6e94358f89a41066193d5
SHA256

ab558610c921655b4c5533175b9c55c8798b578fd87ca0d7047d22ec9669b250
SHA512

d1c83b2faf1cd92f1ce313fb8650ebc1ac351cc8883ee5f48da80cbf35a15d8aefb15000c8dc47298b0af9db4beaf3bdd238bdc021c7dc7871dbba2054abbe40
SSDEEP

3072:+QCg4Kp8l8VutkQPFyQQz70DXdbrv3ADzWRj:+rg4KaleuyQPFQz7Cju

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3372	5048	regsvr32.exe	14
PID 5048 wrote to memory of 3372	5048	regsvr32.exe	14
PID 5048 wrote to memory of 3372	5048	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4a3784752f28a3b6a4d822c25386c73e.dll
1⤵
PID:3372

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a3784752f28a3b6a4d822c25386c73e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3372-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3372-1-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download