Analysis
-
max time kernel
13s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 01:49
Static task
static1
Behavioral task
behavioral1
Sample
TAX DOCUMENTS 2/1099-MISC.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TAX DOCUMENTS 2/1099-MISC.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TAX DOCUMENTS 2/W2_2023.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TAX DOCUMENTS 2/W2_2023.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
TAX DOCUMENTS 2/g2m.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
TAX DOCUMENTS 2/g2m.dll
Resource
win10v2004-20240226-en
General
-
Target
TAX DOCUMENTS 2/g2m.dll
-
Size
100.0MB
-
MD5
fdd7fab01cc9eb7349f24ef1dbd60721
-
SHA1
b749ad4a425671627562fba3a956672287ea0ac2
-
SHA256
5b56f1de607f06430e1207d3d4cb2f9f353be1958f48c95a55d7ce5fe1535e67
-
SHA512
3ccba57756e93c1ca8acc4bdace284831af299b227bc7f3f825bf193acf0bbcc8d3f382c5f497e3d167c42f69e241c3cffc0066851ca078bcc201fa5b56a47fa
-
SSDEEP
196608:r8u0ivGTAslgbSYBsnBho/wnBvq+4rMOblxz6qYFS1qY2aubxi58/EUxFFVszp:r8uzvfaEog+4rdbUTFVk
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1888 wrote to memory of 2956 1888 regsvr32.exe regsvr32.exe PID 1888 wrote to memory of 2956 1888 regsvr32.exe regsvr32.exe PID 1888 wrote to memory of 2956 1888 regsvr32.exe regsvr32.exe PID 1888 wrote to memory of 2956 1888 regsvr32.exe regsvr32.exe PID 1888 wrote to memory of 2956 1888 regsvr32.exe regsvr32.exe PID 1888 wrote to memory of 2956 1888 regsvr32.exe regsvr32.exe PID 1888 wrote to memory of 2956 1888 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2956-0-0x0000000010000000-0x0000000010F94000-memory.dmpFilesize
15.6MB
-
memory/2956-1-0x0000000010000000-0x0000000010F94000-memory.dmpFilesize
15.6MB
-
memory/2956-2-0x0000000010000000-0x0000000010F94000-memory.dmpFilesize
15.6MB
-
memory/2956-3-0x0000000010000000-0x0000000010F94000-memory.dmpFilesize
15.6MB
-
memory/2956-4-0x00000000001F0000-0x00000000001FA000-memory.dmpFilesize
40KB
-
memory/2956-5-0x00000000001F0000-0x00000000001FA000-memory.dmpFilesize
40KB