c4079adbd900f429976e7363d635dca803e7d244675263ebb30b1ea8fc889e29 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 23:30

Sharing

Report Analysis Logs

General

Target

PublicModulePlusin.dll
Size

2.5MB
MD5

ac5b798479b163e732574ff442001559
SHA1

570ba95fd366ba902b935bd12d0c74d954ca377e
SHA256

1430b1e59ec9c9647964618306105c7a040f9f9e1ceb9f22b255843dedbba695
SHA512

4d69e38d9481fca84f00a75c3514209bb4f2eee68acbd77340c4909b04f885f8a03b67823765ced863fdc34e8a0d624c16631ff7acf20e77a7107e35113b8d91
SSDEEP

49152:R76zFMWgFFS0OfWtz8LQ4/1kYrLALX+2/aQ:RGzF9gbOfWtm1rLALO2L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3000	2984	regsvr32.exe	28
PID 2984 wrote to memory of 3000	2984	regsvr32.exe	28
PID 2984 wrote to memory of 3000	2984	regsvr32.exe	28
PID 2984 wrote to memory of 3000	2984	regsvr32.exe	28
PID 2984 wrote to memory of 3000	2984	regsvr32.exe	28
PID 2984 wrote to memory of 3000	2984	regsvr32.exe	28
PID 2984 wrote to memory of 3000	2984	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PublicModulePlusin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\PublicModulePlusin.dll
  2⤵
  PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000002400000-0x0000000002688000-memory.dmp

Filesize
2.5MB

Download