bae002964bf0f8f5c3d816c2ea63d57db427b96c39a23f5c02f142b11ae4128b | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 11:23

Sharing

Report Analysis Logs

General

Target

74921d6af9115ae588f6c0c4f164b43e.dll
Size

227KB
MD5

74921d6af9115ae588f6c0c4f164b43e
SHA1

ad4e3825b9ea3c10d1f86ee65f4eed63750fdd2e
SHA256

bae002964bf0f8f5c3d816c2ea63d57db427b96c39a23f5c02f142b11ae4128b
SHA512

4dc6c53600159648dae90c481bb34ca75d5a0d830c89cfd54fb0f3b93df108468124a0f225fb198096ba96a035f785ca63008cd6d93805356a31e11cf2b021e3
SSDEEP

6144:LX2dYYMX2dYYMX2dYYMX2dYYMX2dYYMX2dYYMX2dYY:rTTTTTT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2900	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2900	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2900	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2900	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2900	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2900	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2900	2032	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74921d6af9115ae588f6c0c4f164b43e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74921d6af9115ae588f6c0c4f164b43e.dll
  2⤵
  PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download