6a21c7a306bbef291d24483393b4eb2f9fe2f266c984e2db6d6ae594f58ac8b0 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 13:14

Sharing

Report Analysis Logs

General

Target

a1f1a0d0642a7c54c726932db3a038fa.dll
Size

79KB
MD5

a1f1a0d0642a7c54c726932db3a038fa
SHA1

69eb7a5814acf0dad353ef221bf3d150be2a66dd
SHA256

6a21c7a306bbef291d24483393b4eb2f9fe2f266c984e2db6d6ae594f58ac8b0
SHA512

f8a40ad40d91c3e590f14cddd4d1919a5b909ad66985b12ae96c7641903f7909808029d47feef28c29df260af544c13340bab208b0d49ed8ebaec8ee8bfef63d
SSDEEP

1536:Z06009tdRhA70BrJBiEWyupqp8rIJUGtJo6BrV:ZHdPXT57KqyIJJty6Bh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1656	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1656	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1656	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1656	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1656	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1656	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1656	2008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a1f1a0d0642a7c54c726932db3a038fa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a1f1a0d0642a7c54c726932db3a038fa.dll
  2⤵
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads