1c9a836297a4ec1a100419900bcb2f4ec2539b64e20c4378cb25d43258fc5b1c | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88e29ece80d0030f230c2c2060c09671.dll
Size

29KB
MD5

88e29ece80d0030f230c2c2060c09671
SHA1

6e2c301c2726fef62c4368c1d92b4e7716bbd972
SHA256

1c9a836297a4ec1a100419900bcb2f4ec2539b64e20c4378cb25d43258fc5b1c
SHA512

7a5792615d9320a1d1774347a770ce17cc330f90d726b8f54517d981c5b9244ce8e38ad977eb4775f36267bffffbb4db6dd889285013ec813de3c2334ad4c5bc
SSDEEP

768:mKSqquxD0GQngRJMesMzSAVKT/PD9pdhPwiLK:SqquxD0GQ2PsMsD9PqkK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 1828	812	regsvr32.exe	28
PID 812 wrote to memory of 1828	812	regsvr32.exe	28
PID 812 wrote to memory of 1828	812	regsvr32.exe	28
PID 812 wrote to memory of 1828	812	regsvr32.exe	28
PID 812 wrote to memory of 1828	812	regsvr32.exe	28
PID 812 wrote to memory of 1828	812	regsvr32.exe	28
PID 812 wrote to memory of 1828	812	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88e29ece80d0030f230c2c2060c09671.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\88e29ece80d0030f230c2c2060c09671.dll
  2⤵
  PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads