f9b242b940116c54eace1a2edb7e11759b4889cbb8080563f790d3612be24947 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 23:35

Sharing

Report Analysis Logs

General

Target

6653d68242fce46c783e57ad21ea7074.dll
Size

35KB
MD5

6653d68242fce46c783e57ad21ea7074
SHA1

3c560e598f879e3ad32858c949a45187fd62be74
SHA256

f9b242b940116c54eace1a2edb7e11759b4889cbb8080563f790d3612be24947
SHA512

51b75415f1550cb8b346f454703bf188a5cc6bcd5dbe3c96b6ef57a0e27e6e39443fdd032a5cc6d72732110f7ae5ab71795ffab0dee93c13116e89c9f2cc31a0
SSDEEP

768:+Qoi6qZO1Qegd2pTaCfC13ax5WemdVGTJ3GRLN:+Qv6qZ4Q34Ta4CRaxOyGRLN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2200	1696	regsvr32.exe	28
PID 1696 wrote to memory of 2200	1696	regsvr32.exe	28
PID 1696 wrote to memory of 2200	1696	regsvr32.exe	28
PID 1696 wrote to memory of 2200	1696	regsvr32.exe	28
PID 1696 wrote to memory of 2200	1696	regsvr32.exe	28
PID 1696 wrote to memory of 2200	1696	regsvr32.exe	28
PID 1696 wrote to memory of 2200	1696	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6653d68242fce46c783e57ad21ea7074.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6653d68242fce46c783e57ad21ea7074.dll
  2⤵
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-0-0x00000000000D0000-0x00000000000DE000-memory.dmp

Filesize
56KB

Download