d0e61d25a911824250622ff4b8b7b27360473894b450ad66a22f7160ad2efe92 | Triage

Analysis

max time kernel
111s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 03:38

Sharing

Report Analysis Logs

General

Target

TaijiName/olepro32.dll
Size

81KB
MD5

bb587d669cb61ebb4adeacae7d6f8ad0
SHA1

de4fe24756c1813f765b56ae115db2615cdeec1a
SHA256

b9ce551e3c6624b57994f9898d08533859668373914d0cd103f86da4c5dcd9f3
SHA512

1c6bea69cdad77cef49fa9ce1598c6ebc6e8b1a9089ec329ce3fd8b0ce545a4a40135461f25974dd6f738ea531e8631f6578c38b900463555268961cb715fe1a
SSDEEP

1536:10TQEyiulHkC1oePj8hEeja/OdR2fQHfWytMNwTs:10TQNRkUTj2EejpdsfQ/WSts

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4628	3204	regsvr32.exe	84
PID 3204 wrote to memory of 4628	3204	regsvr32.exe	84
PID 3204 wrote to memory of 4628	3204	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TaijiName\olepro32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TaijiName\olepro32.dll
  2⤵
  PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads