bfeaf1fe93923425053e245e2ccefae72a65f75edad1f1689c55c4f0a1e84455 | Triage

Analysis

max time kernel
1558s
max time network
1558s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 10:41

Sharing

Report Analysis Logs

General

Target

PyHelper.dll
Size

236KB
MD5

b7bd2243978cfe44cc0d4b28086c4004
SHA1

bbc0f43de71cddc0a1be48fa98b936ebffb817ac
SHA256

bfeaf1fe93923425053e245e2ccefae72a65f75edad1f1689c55c4f0a1e84455
SHA512

e7f924564bcf1a6173cf29bbbcb16994b3e527a93c1059e7be8e86aa5f5887a852a6a9084862caf3e192a5a70336e6ee22bc169c1f1e0300fa72bb9049a0141f
SSDEEP

3072:aSro30CSFTVOo7qzijtY7HBGsBel05YGoAgbceBBCxRXu+E+NO9o6Kgv:akoELH7k8tY7HkLljr1CTbE55

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description pid process

PID 804 wrote to memory of 0 804 regsvr32.exe
PID 804 wrote to memory of 0 804 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PyHelper.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:804

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-0-0x0000000062540000-0x0000000062598000-memory.dmp

Filesize
352KB

Download
memory/804-1-0x0000000062540000-0x0000000062598000-memory.dmp

Filesize
352KB

Download
memory/804-2-0x0000000062540000-0x0000000062598000-memory.dmp

Filesize
352KB

Download
memory/804-4-0x0000000062540000-0x0000000062598000-memory.dmp

Filesize
352KB

Download