edbef9cf8a5e7723ccf89701a37368d3b13793e49feefbd7e1a9501d70d108a4 | Triage

Analysis

max time kernel
138s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:44

Sharing

Report Analysis Logs

General

Target

4a5a0db04967425aabe9d3b73470c896.dll
Size

59KB
MD5

4a5a0db04967425aabe9d3b73470c896
SHA1

526298d2456f698d4a696da6786a21c8d3e53550
SHA256

edbef9cf8a5e7723ccf89701a37368d3b13793e49feefbd7e1a9501d70d108a4
SHA512

83b503a375f2d97954926954ef0dd81bd3cb63978c8d4bd503ab71094e16b7e4cba71f56e6bc5039b16807ea7cf1780140b3a302207591031511f7eae477e925
SSDEEP

1536:vIyrU9gwX1itmWFU0ZWEXmt+DhdweAxj0HIrjw4eL2:vIaObitmWFnWqmLfw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4732	1616	regsvr32.exe	14
PID 1616 wrote to memory of 4732	1616	regsvr32.exe	14
PID 1616 wrote to memory of 4732	1616	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4a5a0db04967425aabe9d3b73470c896.dll
1⤵
PID:4732

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a5a0db04967425aabe9d3b73470c896.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4732-0-0x00000000005C0000-0x00000000005FA000-memory.dmp

Filesize
232KB

Download
memory/4732-2-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/4732-1-0x00000000005C0000-0x00000000005FA000-memory.dmp

Filesize
232KB

Download