cdd9213c986f4dcc1f2c07f584d564c6a3ba00c9c27fe016bf51fd70ff0ef973 | Triage

Resubmissions

28-03-2024 13:35

240328-qvvdysfd4s 4

21-03-2024 15:21

240321-srcqvaed68 10

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-03-2024 15:21

Sharing

Report Analysis Logs

General

Target

Bull140U.dll
Size

3.2MB
MD5

beeb151d977f3a5c505e6235fce14254
SHA1

9547ccc48e35effef55891d9ac91aca118335cf0
SHA256

ce673d3e52f338333790a0214a5032bc498af64a538158e7f4c540b40e0f6b04
SHA512

1d12d39ff8d46021c8241a41ecc3875d8f017bb1d3b7abad8aa2c945b2b4c0472900ef5a7feabce657fb8a55f3586f9ad76d9e836c43cb3502b2bace32dbe985
SSDEEP

49152:eucCrMzcHiNTP0aVY+cTiPA+uo8TWh6UU3JxpHIWkU1ZwnlmdE:ZPCtVYfbnoV6UCZHIxZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3052	1444	regsvr32.exe	28
PID 1444 wrote to memory of 3052	1444	regsvr32.exe	28
PID 1444 wrote to memory of 3052	1444	regsvr32.exe	28
PID 1444 wrote to memory of 3052	1444	regsvr32.exe	28
PID 1444 wrote to memory of 3052	1444	regsvr32.exe	28
PID 1444 wrote to memory of 3052	1444	regsvr32.exe	28
PID 1444 wrote to memory of 3052	1444	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
  2⤵
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads