786e64e5e63aaf2402a525edd6b9164ffd26b64b542fcfc1f3a2b43c5f5adeb7 | Triage

Analysis

max time kernel
155s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 12:01

Sharing

Report Analysis Logs

General

Target

5b3026a70cc34f32ba4d03a046da21a0.dll
Size

120KB
MD5

5b3026a70cc34f32ba4d03a046da21a0
SHA1

a3a20585ae0b282bfd0e3df25232861d0f2157d2
SHA256

786e64e5e63aaf2402a525edd6b9164ffd26b64b542fcfc1f3a2b43c5f5adeb7
SHA512

13f5d9876ad1adc96a878cd942cb7ba7030b97a41c3e01e645a8f5df3c423c7ff5428eabe93051929f7bbdbc57003623bfad3f7b5d6042ca9f18e8ffe6a02ee8
SSDEEP

1536:63xq2QMa7kkK5gPIH2Gl1lqEF8y4jF6d16zBjwvObd1:6bNaAEoQzHjFn9jVd1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3624	4192	regsvr32.exe	88
PID 4192 wrote to memory of 3624	4192	regsvr32.exe	88
PID 4192 wrote to memory of 3624	4192	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5b3026a70cc34f32ba4d03a046da21a0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5b3026a70cc34f32ba4d03a046da21a0.dll
  2⤵
  PID:3624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3624-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download