c486b3ea362c122d2ac9507a474f0df7eed2ebcd4db060a6a5f0ee25a51285bb | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 15:59

Sharing

Report Analysis Logs

General

Target

lregistry.dll
Size

56KB
MD5

194935c06125e59c1ef6b115c216c52c
SHA1

80b4e778f37e1d43ce4f0820759d8a20d0386504
SHA256

cf74cf55791780249bdfb8324338d7eb192150bc08846ab5a46d9141f2f30e75
SHA512

f2ce8ffb42bef807e1c2b3e0b6a7a97dce598af837264ecb139e1908a79dfd348c50b2644065ee971c318ac4abbef982b133944fc2f3cc9a8cb7ba4e91f1d397
SSDEEP

768:0ML9X9I8hmi9QdHgv8FTcgoAAReeUbaN9AefWgTKTJFKDPIORDz:5L9CmmizOjZ695rTKybR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	3032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 2976 wrote to memory of 3032	2976	rundll32.exe	28
PID 3032 wrote to memory of 3048	3032	rundll32.exe	29
PID 3032 wrote to memory of 3048	3032	rundll32.exe	29
PID 3032 wrote to memory of 3048	3032	rundll32.exe	29
PID 3032 wrote to memory of 3048	3032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lregistry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lregistry.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 220
    3⤵
    - Program crash
    PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads