eeab79e2fd26a52c2cfe6fb85d773815c7f6ed40f4efbe4ebb66a091e0e5cfdc | Triage

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 12:22

Sharing

Report Analysis Logs

General

Target

7a3dd54ae78445a630500ddd4fba3044.dll
Size

101KB
MD5

7a3dd54ae78445a630500ddd4fba3044
SHA1

556dd213dda4c1e90e19b781b9dff0740e7cdcd9
SHA256

eeab79e2fd26a52c2cfe6fb85d773815c7f6ed40f4efbe4ebb66a091e0e5cfdc
SHA512

5c7abedda4e482f6a91e4d66d2f432051e830fff18559a5800b54a267f19e931f373e63da17f49392461c16e02d96793e45d8741f2a7dd884b6badc1dc620548
SSDEEP

3072:fWfPD50tDfBw/A2+5C2ie8/HjXoAgdL0/u:fK5IDfW/A3C2iHTgdL02

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1472	2008	regsvr32.exe	87
PID 2008 wrote to memory of 1472	2008	regsvr32.exe	87
PID 2008 wrote to memory of 1472	2008	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7a3dd54ae78445a630500ddd4fba3044.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7a3dd54ae78445a630500ddd4fba3044.dll
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1472-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download