c9025f4e07447f8655a994c8c477266baff693c7f11cc1dc85292c333b4a83da | Triage

Analysis

max time kernel
130s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 05:18

Sharing

Report Analysis Logs

General

Target

ֽ/PROPSYS.dll
Size

20.2MB
MD5

a5276062c5443c09cdb8ad91ce2ee76a
SHA1

6d82ad12e4c48aa827875cdd068c8b1ac07d1ab3
SHA256

e664e61df30a27739c0126cdff022eb19993f2a670383cbbe54b64841e253a6a
SHA512

2446663530c5114e9b0b435bdfd8c352f8214d7ffd1160ad74b3022404e9ed71ad38714ef1644ce68a376753d3601d6199277e9908a74851c7acc8e9afb15168
SSDEEP

98304:Qd3xBTcP6Iqw1yCfPJcvpouwQR2NfTGJsoK+ahHiEZzKGUadd9Med:xf1yCfSvAQS7GJAZzK2d9X

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2352 wrote to memory of 3308 2352 regsvr32.exe cmd.exe
PID 2352 wrote to memory of 3308 2352 regsvr32.exe cmd.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ֽ\PROPSYS.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\system32\cmd.exe
cmd ver
2⤵
PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...