1c9a836297a4ec1a100419900bcb2f4ec2539b64e20c4378cb25d43258fc5b1c | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 07:09

Sharing

Report Analysis Logs

General

Target

88e29ece80d0030f230c2c2060c09671.dll
Size

29KB
MD5

88e29ece80d0030f230c2c2060c09671
SHA1

6e2c301c2726fef62c4368c1d92b4e7716bbd972
SHA256

1c9a836297a4ec1a100419900bcb2f4ec2539b64e20c4378cb25d43258fc5b1c
SHA512

7a5792615d9320a1d1774347a770ce17cc330f90d726b8f54517d981c5b9244ce8e38ad977eb4775f36267bffffbb4db6dd889285013ec813de3c2334ad4c5bc
SSDEEP

768:mKSqquxD0GQngRJMesMzSAVKT/PD9pdhPwiLK:SqquxD0GQ2PsMsD9PqkK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4496	5072	regsvr32.exe	84
PID 5072 wrote to memory of 4496	5072	regsvr32.exe	84
PID 5072 wrote to memory of 4496	5072	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88e29ece80d0030f230c2c2060c09671.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\88e29ece80d0030f230c2c2060c09671.dll
  2⤵
  PID:4496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads