54e7b2237d323a445de3206c1c9a43a41c766374139db71bd72e273f7b8f87f6 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:24

Sharing

Report Analysis Logs

General

Target

75157952e643732889c978b8e05382c2.dll
Size

52KB
MD5

75157952e643732889c978b8e05382c2
SHA1

7a6cb3af1a19df54e52f788e443b446854b368d4
SHA256

54e7b2237d323a445de3206c1c9a43a41c766374139db71bd72e273f7b8f87f6
SHA512

32feacf828ba596e044d3f38a39aac856f817056289de95003996b558fafc425ce5f78637a277103e6db74182df035a2ee3ececda5059541eb0d954b59da35bb
SSDEEP

768:wIDLrjeTKJuIC+lxyoUCkNVN4SDyIwG7Hs:wIDLrjyKJuvoUBKSfwG7Hs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2032 wrote to memory of 2388	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2388	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2388	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2388	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2388	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2388	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2388	2032	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\75157952e643732889c978b8e05382c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\75157952e643732889c978b8e05382c2.dll
2⤵
PID:2388

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...