a5e45576ab7efbe384002eb99630d77f2cbc42da6bf0bd6bc522f23069ec5b33 | Triage

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:24

Sharing

Report Analysis Logs

General

Target

MMDevAPI.dll
Size

344KB
MD5

dd8eac114e86965fcd82552f889ed23a
SHA1

bcbaa910970a6247821965ff04f60133684ca048
SHA256

a5e45576ab7efbe384002eb99630d77f2cbc42da6bf0bd6bc522f23069ec5b33
SHA512

8228a2ef731ea40befdf3035021979d3dcb7e05438e514223270083b66505c787715950e58804e8266dd1b364d046a60749462c7a9eb4ca0c509158afb321d27
SSDEEP

6144:CEjPZQ4t13mDSgiZhMYJdRppenoAd2c595erJmhi:CePZD3mW7ZhFJVpbAUs4rD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4900	2760	regsvr32.exe	82
PID 2760 wrote to memory of 4900	2760	regsvr32.exe	82
PID 2760 wrote to memory of 4900	2760	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MMDevAPI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MMDevAPI.dll
  2⤵
  PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads