bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 15:11

Sharing

Report Analysis Logs

General

Target

IUser.dll
Size

152KB
MD5

85b1375725843284c7987b6bad170bcc
SHA1

490e87557116cc75167044d18f50af47167df467
SHA256

36f4b8a79035b4df985dbeae8e42312a6ff74d947275ac312d5f2a3fd45b4030
SHA512

7fc14814bc06c176796c0fbab17dd2131859db35f5c53685792d8e1c0b2ca3da16af017df20b0f035ef44a10bb92c5a556e26ed1a37f16bf3ad3e7212f74d02c
SSDEEP

3072:QUJ07LpRZLzwIWBmSoAExjbctb7gnWwJfc/UNU:R0RHzMBm8tbV8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2116 wrote to memory of 4772	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 4772	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 4772	2116	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\IUser.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\IUser.dll
2⤵
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...