bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 15:11

Sharing

Report Analysis Logs

General

Target

ctor.dll
Size

56KB
MD5

e3db818aca6889a18fee5ebef336d305
SHA1

d68f8cc397f448c5fa6265642833a36a680e60ae
SHA256

ad48c416a57a9f8a47ec4c8f82f25430a2da42730c3891b43a44c1f21e7f5932
SHA512

1c44160f74b7afe992e6818689e375e88d07203856f6167e1602ead64210bd09787c2fb41ba31f21542861bcbc67f03b45e113937a9b069e8e5e2dadee9785e4
SSDEEP

768:j1npoNeR33mrMTCnbvyZn6TF8cg4IL+nhmurNVNVtfyyuCNcnbMv9mnf:j1eNwm/baYGqPSzrAv9Of

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2956 wrote to memory of 2968	2956	regsvr32.exe	regsvr32.exe
PID 2956 wrote to memory of 2968	2956	regsvr32.exe	regsvr32.exe
PID 2956 wrote to memory of 2968	2956	regsvr32.exe	regsvr32.exe
PID 2956 wrote to memory of 2968	2956	regsvr32.exe	regsvr32.exe
PID 2956 wrote to memory of 2968	2956	regsvr32.exe	regsvr32.exe
PID 2956 wrote to memory of 2968	2956	regsvr32.exe	regsvr32.exe
PID 2956 wrote to memory of 2968	2956	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ctor.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ctor.dll
2⤵
PID:2968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...