Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
15/03/2024, 10:58
General
- Target cb3ac26db1162a5fa84c307b6ca95f30.dll
- Size 187KB
- Sample240315-m2v3aagg95
- SHA256 ca65df7f3b4596ed9242651c9a6d97aa3dee1aaae9addc3053d39fb00a6f7339
Malware Config
Signatures
- Program crash 1 IoCs
- Modifies registry class 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb3ac26db1162a5fa84c307b6ca95f30.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cb3ac26db1162a5fa84c307b6ca95f30.dll2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 6283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2000 -ip 20001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2000-0-0x0000000075020000-0x0000000075067000-memory.dmp
memory/2000-1-0x0000000002D30000-0x0000000002D60000-memory.dmp
memory/2000-2-0x0000000002C20000-0x0000000002C23000-memory.dmp
memory/2000-3-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/2000-4-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/2000-5-0x00000000012D0000-0x00000000012D1000-memory.dmp
memory/2000-6-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/2000-7-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/2000-8-0x0000000002F00000-0x0000000002F01000-memory.dmp
memory/2000-10-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/2000-9-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/2000-11-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/2000-12-0x0000000002F80000-0x0000000002F81000-memory.dmp
memory/2000-13-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
memory/2000-14-0x0000000002F90000-0x0000000002F91000-memory.dmp
memory/2000-15-0x0000000003030000-0x0000000003031000-memory.dmp
memory/2000-16-0x0000000003060000-0x0000000003061000-memory.dmp
memory/2000-18-0x0000000003070000-0x0000000003071000-memory.dmp
memory/2000-19-0x00000000030A0000-0x00000000030A1000-memory.dmp
memory/2000-17-0x0000000003050000-0x0000000003051000-memory.dmp
memory/2000-20-0x00000000030B0000-0x00000000030B1000-memory.dmp
memory/2000-22-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/2000-21-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/2000-23-0x00000000031F0000-0x00000000031F1000-memory.dmp
memory/2000-24-0x0000000003210000-0x0000000003211000-memory.dmp
memory/2000-25-0x0000000003200000-0x0000000003201000-memory.dmp
memory/2000-26-0x0000000003240000-0x0000000003241000-memory.dmp
memory/2000-27-0x0000000075020000-0x0000000075067000-memory.dmp