8c8a90e3c41567dc8b18ba91308e0af5adc21ecc72b5ea75e3b5ba0ddd8a2e66 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc3551cfcf5ab4b003d2ad0ca1e8f1f6.dll
Size

158KB
MD5

cc3551cfcf5ab4b003d2ad0ca1e8f1f6
SHA1

b9586e84964b55a632c763fb7fc4571e2c416f96
SHA256

8c8a90e3c41567dc8b18ba91308e0af5adc21ecc72b5ea75e3b5ba0ddd8a2e66
SHA512

1c1dd5affa2545cd78606b08a8096b715dc02c936e70fe573bf89b375a0665c58ef44ff7019fcdacd98f1f7ced871c226b87dd845d33de91f05c3982c181ed1a
SSDEEP

3072:/c0LpqrzgYMEbgq9itcYqTP4r6e9PiScd:VLpYFrQtcHP4rB8Bd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1744	2656	regsvr32.exe	28
PID 2656 wrote to memory of 1744	2656	regsvr32.exe	28
PID 2656 wrote to memory of 1744	2656	regsvr32.exe	28
PID 2656 wrote to memory of 1744	2656	regsvr32.exe	28
PID 2656 wrote to memory of 1744	2656	regsvr32.exe	28
PID 2656 wrote to memory of 1744	2656	regsvr32.exe	28
PID 2656 wrote to memory of 1744	2656	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cc3551cfcf5ab4b003d2ad0ca1e8f1f6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cc3551cfcf5ab4b003d2ad0ca1e8f1f6.dll
  2⤵
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-0-0x0000000000170000-0x00000000001B3000-memory.dmp

Filesize
268KB

Download