d5ef4e6278d7fc3d486d5689b27fb14ea182706d04508bf20068ada1d7a72638 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76c0935edd58a8c99971a6ad58743d74.dll
Size

160KB
MD5

76c0935edd58a8c99971a6ad58743d74
SHA1

873ee41320bff86b4e518bbe581418b2cbc69f3c
SHA256

d5ef4e6278d7fc3d486d5689b27fb14ea182706d04508bf20068ada1d7a72638
SHA512

c9058c5c5c2a33f137458240cf3cc3bd316fd853a81bb5a09e498cba632a30e3c79430613f255dbc39a6967ffb3aebf43313f0511bb707a235baacfc3259d34a
SSDEEP

3072:ZbDC5t3Q5nYhX6gbxNT4gfoPEmxbIvlkwhcP:ZbmfA5nYhKi65ZxbIvlkwhw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2092	3040	regsvr32.exe	20
PID 3040 wrote to memory of 2092	3040	regsvr32.exe	20
PID 3040 wrote to memory of 2092	3040	regsvr32.exe	20
PID 3040 wrote to memory of 2092	3040	regsvr32.exe	20
PID 3040 wrote to memory of 2092	3040	regsvr32.exe	20
PID 3040 wrote to memory of 2092	3040	regsvr32.exe	20
PID 3040 wrote to memory of 2092	3040	regsvr32.exe	20

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\76c0935edd58a8c99971a6ad58743d74.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\76c0935edd58a8c99971a6ad58743d74.dll
  2⤵
  PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads