7bf569ca4979d7213208a0c04e838c64bb9a57a9c6fbca1d7c7dc86928cc3423 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 06:09

Sharing

Report Analysis Logs

General

Target

b6b387145f911b7f4f3d5bff507e8a57.dll
Size

136KB
MD5

b6b387145f911b7f4f3d5bff507e8a57
SHA1

4c4ee872ebcdbba8a25a1316b8b8fb48f7af8a5d
SHA256

7bf569ca4979d7213208a0c04e838c64bb9a57a9c6fbca1d7c7dc86928cc3423
SHA512

50b8af2c1ba6594be37944acfbf3b4ad91df0014ecec3c095c0849031acac6705e33824441bf74e89f20e223a96ac620c4848c41e1db1490d935f2371815bc05
SSDEEP

1536:5FqeQ2Ev0LzaFUe3HoggWg1Lyu/zFrEvkbFeg:p7Ev+mV2Lyu/zFrug

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2192	2492	regsvr32.exe	28
PID 2492 wrote to memory of 2192	2492	regsvr32.exe	28
PID 2492 wrote to memory of 2192	2492	regsvr32.exe	28
PID 2492 wrote to memory of 2192	2492	regsvr32.exe	28
PID 2492 wrote to memory of 2192	2492	regsvr32.exe	28
PID 2492 wrote to memory of 2192	2492	regsvr32.exe	28
PID 2492 wrote to memory of 2192	2492	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6b387145f911b7f4f3d5bff507e8a57.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b6b387145f911b7f4f3d5bff507e8a57.dll
  2⤵
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000000160000-0x0000000000182000-memory.dmp

Filesize
136KB

Download