bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e | Triage

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 15:11

Sharing

Report Analysis Logs

General

Target

Disk1/ISSetup.dll
Size

1.6MB
MD5

82785d52aff250d92e6c415a84f3a0cb
SHA1

f18d27f5b4fa37fb77f3c24fd96d6075db759580
SHA256

89b71ad218a00b8ca87136266d841240dd8d00ad4e8745b28c9a8cf775623937
SHA512

decdc14dc3d77bc25a30ac16095a2045b5ccb6fad99fe652e0477ac08524762ed7c3b39fcb2e90ddfd5ef1752f609522d9c6b9794450536761c6195862eb89c2
SSDEEP

49152:OUiWx78RtgmwjQs4o6C5WZ/l0+VChSV9TE2/:tZ8RtgmwjQj/HZ/+eChm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3572 wrote to memory of 5096	3572	regsvr32.exe	regsvr32.exe
PID 3572 wrote to memory of 5096	3572	regsvr32.exe	regsvr32.exe
PID 3572 wrote to memory of 5096	3572	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Disk1\ISSetup.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Disk1\ISSetup.dll
2⤵
PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...