fdbff013b835081580756a378afeb8c6897a345f6934fa54d1c71ade4d15fe7f | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 02:44

Sharing

Report Analysis Logs

General

Target

$APPDATA/15/metade.dll
Size

40KB
MD5

6ce0a00b9c336497b08106982b5f34d7
SHA1

5a513e808470c9375d99096020e021340ebef332
SHA256

1c55dab99bdf7461f211af018ce84478ff76f230133bfe3f8ed4b535a6a3cbd1
SHA512

abefa479dd072165c12cd4a04107fda982f2002bf33c28d8038b673632cf8f45e59ebc56c2501c7d12ed28e502361f95382322e7c3dc545601e0264f9e183ed8
SSDEEP

768:/lM05vRJQLrGB8vH/MON6s9+nQ8TYtehb1QsJcHO3pflk:i05ELr48vH/MOkDQ8TYteAsaHO5fl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1296 wrote to memory of 2996	1296	regsvr32.exe	regsvr32.exe
PID 1296 wrote to memory of 2996	1296	regsvr32.exe	regsvr32.exe
PID 1296 wrote to memory of 2996	1296	regsvr32.exe	regsvr32.exe
PID 1296 wrote to memory of 2996	1296	regsvr32.exe	regsvr32.exe
PID 1296 wrote to memory of 2996	1296	regsvr32.exe	regsvr32.exe
PID 1296 wrote to memory of 2996	1296	regsvr32.exe	regsvr32.exe
PID 1296 wrote to memory of 2996	1296	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\15\metade.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\15\metade.dll
  2⤵
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads