7d58b21565bd4e1025e1a82f1209e30b1a7c67d0a7000b04cbbd83662d1812d2 | Triage

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 12:39

Sharing

Report Analysis Logs

General

Target

MCore.dll
Size

1.3MB
MD5

adadd2d19c819246bc36cf60bebefd6b
SHA1

958138d965f38274f5ad388e9f5e87209d07708d
SHA256

6194a61b63788216bbde03b99d0fec5c5701c799fc6c7657b424cc26aa2fc220
SHA512

270bd44f40d91c02a4738b3380986b9003326cd18c1e3539648046683cebdedefbea39a1f6bb5391e98e3fbaeb6053b4f8cebdb75d6d12b2efae20f1c06a96f2
SSDEEP

24576:MmqCmtr0WN6gA/4KEHg7ihke/+14jljFu0uTqkCftH:MJp0WNO/4KEHLke/24VFOqkCftH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1940	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1940	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1940	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1940	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1940	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1940	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1940	1928	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MCore.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MCore.dll
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads