30242aaa99232db3e611481f2b3ed6f31b04f5d3111d0a8cc15e3531e80f81e2 | Triage

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 15:29

Sharing

Report Analysis Logs

General

Target

b7bec693921820d5c556c951fa7b0d6c.dll
Size

34KB
MD5

b7bec693921820d5c556c951fa7b0d6c
SHA1

8af2eee611b19218037abc80ef9b7283f0d447dc
SHA256

30242aaa99232db3e611481f2b3ed6f31b04f5d3111d0a8cc15e3531e80f81e2
SHA512

a5b485f8fbb2e871c1608dd0e713f944edd3556bdefd448ca18181a4c817321a3f62d715663a4a6b9bec06f765a6ba2a2819563c9618b09e6bdb60dd3c5df62d
SSDEEP

768:nQoi6qZO1Qegd2loF/V7zH0S2yDd2mLJ3+AF:nQv6qZ4Q3pT3H0Er+AF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3008	1116	regsvr32.exe	28
PID 1116 wrote to memory of 3008	1116	regsvr32.exe	28
PID 1116 wrote to memory of 3008	1116	regsvr32.exe	28
PID 1116 wrote to memory of 3008	1116	regsvr32.exe	28
PID 1116 wrote to memory of 3008	1116	regsvr32.exe	28
PID 1116 wrote to memory of 3008	1116	regsvr32.exe	28
PID 1116 wrote to memory of 3008	1116	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7bec693921820d5c556c951fa7b0d6c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b7bec693921820d5c556c951fa7b0d6c.dll
  2⤵
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads