d7e11b178fcc3d1ee7f6ad3dce6da2ea043de64d521cf3578fb09031cbdb0ae2 | Triage

Analysis

max time kernel
91s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 15:37

Sharing

Report Analysis Logs

General

Target

$R0.dll
Size

33KB
MD5

c0280971a69869d7a1f3b35793c839f3
SHA1

946356173bdd7d575db1d1b3fb04ed81353e098a
SHA256

c085caea2677b0eeaeecb9afe7e0bad83c2a94fc78d5c3f7819bc7314e54ec69
SHA512

cdd1530aec393c9c07574e9a32214af8fb5eef85a5be02db68e24e05c5e1d88449f064e280d2bcd21aa6921c7545f30965a6724ce810960001964a3c558370ba
SSDEEP

768:i2/5ZWpdwrGUxnyiehH/kmjGyhYlaygOENAMxjI:RBZWpvWa5jrYlNixjI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2660	3344	regsvr32.exe	82
PID 3344 wrote to memory of 2660	3344	regsvr32.exe	82
PID 3344 wrote to memory of 2660	3344	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
  2⤵
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads