b5dc1c1a5d7112d19f225d14b0ba7e704994d619e6b2767be341cbeca885d933 | Triage

Analysis

max time kernel
93s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 23:17

Sharing

Report Analysis Logs

General

Target

$R0.dll
Size

33KB
MD5

d02454e5e342d3f825b57137aa92a345
SHA1

6dbbf9164a54963198affcbf4c5928fdd29afd99
SHA256

b425a8e076dfccf9245d724d3a228500bf128aea9fb24795ee3c6020d2e9df6a
SHA512

625ab607ce7c5e56a29ce9a8eef9dae0d92fc8ac947bb074ea8ad14bb40a6bb79d72c53f4c99a13e6dcd8054fdb95f0b93abcc246442bcccdf82168938e6d63a
SSDEEP

768:82/5ZWpdwrGUxnyiehH/kZjGyxUUyg8GENAMx49:zBZWpvWaGj7UjNXxM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 532	2828	regsvr32.exe	59
PID 2828 wrote to memory of 532	2828	regsvr32.exe	59
PID 2828 wrote to memory of 532	2828	regsvr32.exe	59

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
  2⤵
  PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads