a78f90e2bf4906746ce0751ad95cacbc2b4bf5d1c19d862e682e779188b099d6 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 22:38

Sharing

Report Analysis Logs

General

Target

75af5fca713b03167175b538fb41b7f5.dll
Size

30KB
MD5

75af5fca713b03167175b538fb41b7f5
SHA1

7dd374a3c01758c6d9132b475fb6c52c6002269f
SHA256

a78f90e2bf4906746ce0751ad95cacbc2b4bf5d1c19d862e682e779188b099d6
SHA512

0936469af4f5e46ef27c30db485cac3d1d2aa94f8c243bc8beedabfedb68b49b676ca927afa60ed02a83da8af9041184cb8708f329a5b46f62aa724b9a02195e
SSDEEP

768:SKSqquxD0GQjgRJMe1e6RfhjtT5XUd1jXiE:2qquxD0GQSP1DFoF7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2680	2916	regsvr32.exe	28
PID 2916 wrote to memory of 2680	2916	regsvr32.exe	28
PID 2916 wrote to memory of 2680	2916	regsvr32.exe	28
PID 2916 wrote to memory of 2680	2916	regsvr32.exe	28
PID 2916 wrote to memory of 2680	2916	regsvr32.exe	28
PID 2916 wrote to memory of 2680	2916	regsvr32.exe	28
PID 2916 wrote to memory of 2680	2916	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\75af5fca713b03167175b538fb41b7f5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\75af5fca713b03167175b538fb41b7f5.dll
  2⤵
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-0-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download