b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 15:27

Target

TwistedBrush/ArmAccess.dll
Size

52KB
MD5

86fd498c00a9a8e9c4de7c8c0382835d
SHA1

bd070cd044bc1d31460c85907c61e53455292e0f
SHA256

5d0b8bce53ca837f4147cb48f08995f2ec7efef8ff6c0b7849ad471d96038a5f
SHA512

809477406f50ae78017d66e1c56af4bfb67fb1cc7d5dd46783a270f300fbe7f3209dda3775da04e70ebd2de3d73277b3a14fa96b7e7567de4ba627e0fc3de1b7
SSDEEP

384:vWNNgJdY59tTulkbETxYpx6y2LfiqoYBUcz837yIYh9JzxovS1f2uUIiho38oqee:+IwTulXtkmfZBe7EtFovs2I38ozSihb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2624	2496	regsvr32.exe	28
PID 2496 wrote to memory of 2624	2496	regsvr32.exe	28
PID 2496 wrote to memory of 2624	2496	regsvr32.exe	28
PID 2496 wrote to memory of 2624	2496	regsvr32.exe	28
PID 2496 wrote to memory of 2624	2496	regsvr32.exe	28
PID 2496 wrote to memory of 2624	2496	regsvr32.exe	28
PID 2496 wrote to memory of 2624	2496	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TwistedBrush\ArmAccess.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TwistedBrush\ArmAccess.dll
  2⤵
  PID:2624