bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e | Triage

Resubmissions

02-02-2024 14:59

240202-sc227aggd2 7

02-02-2024 14:53

240202-r9dkesahcq 3

Analysis

max time kernel
589s
max time network
572s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 14:59

Sharing

Report Analysis Logs

General

Target

ctor.dll
Size

56KB
MD5

e3db818aca6889a18fee5ebef336d305
SHA1

d68f8cc397f448c5fa6265642833a36a680e60ae
SHA256

ad48c416a57a9f8a47ec4c8f82f25430a2da42730c3891b43a44c1f21e7f5932
SHA512

1c44160f74b7afe992e6818689e375e88d07203856f6167e1602ead64210bd09787c2fb41ba31f21542861bcbc67f03b45e113937a9b069e8e5e2dadee9785e4
SSDEEP

768:j1npoNeR33mrMTCnbvyZn6TF8cg4IL+nhmurNVNVtfyyuCNcnbMv9mnf:j1eNwm/baYGqPSzrAv9Of

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4260 wrote to memory of 1428	4260	regsvr32.exe	regsvr32.exe
PID 4260 wrote to memory of 1428	4260	regsvr32.exe	regsvr32.exe
PID 4260 wrote to memory of 1428	4260	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ctor.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ctor.dll
2⤵
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...