0db9ac02645846b5033b403a818544371046214bfedef7e70d44f5f825713c00 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 08:59

Sharing

Report Analysis Logs

General

Target

weasel.dll
Size

834KB
MD5

5a905d252c8a73c6dc79ac89038a71f4
SHA1

4e73778dfdb8dcf5a32f3ca9a75ed1b7f65c8058
SHA256

391bf397df1af7efcd78b87f5e551e0a23d8b4e73261b37367e47cb84997cabf
SHA512

945474a9043bbf83c485130699eaf6179e998f200fdcad6647f5991d13caaac052a6783610ed5fed251b2c4375ad28d3e8ae9c4d03063362187d70e921ab3887
SSDEEP

12288:BLI4zGR2ExV87z+lxvhiYmjqEl3DOaDPmWXY3Usk5XgIK:BLIfV87z+lxvhiiEl3D7DP1gU15X

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	28
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	28
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	28
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	28
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	28
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	28
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\weasel.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\weasel.dll
  2⤵
  PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads