Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 22:19

General

  • Target

    $TEMP/certcli.dll

  • Size

    185KB

  • MD5

    f509af061bbf4eb9c39f3cca88c00505

  • SHA1

    a83487b2f41631576606e318ee792de695de72be

  • SHA256

    87ca129af67985dd5ed22913fd02402a9f2a965c13fa83be60fbeb94cbc595cd

  • SHA512

    9b6dee15751d40eb27b8e82bcf88ecee8658be9316a194c8b9492ccf6697f93ae1558adcaa25fe6d317963850bde805f2de6b67cb369adcb228a043741c85365

  • SSDEEP

    3072:2R+zHLqyTs5P/3AqYiHsq4zF4TPhS9JgUjY/Kv0V25N8HJjZ6nssxs3+HNJ8:Z1s5X3ACHsLzFoPhSAUjR0UcH6p

Score
1/10

Malware Config

Signatures

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\certcli.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\$TEMP\certcli.dll
      2⤵
      • Modifies registry class
      PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads