58d6eb07e23a709a8417e4b4ea051891c41703e0bc91f52c552dc18bfebf4318 | Triage

Analysis

max time kernel
138s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:27

Sharing

Report Analysis Logs

General

Target

EhStorAPI.dll
Size

113KB
MD5

91588d95f5dd49d3bad511dddc73d9d7
SHA1

aefdf2614fda7d0230733445ea5983d26dd7d62e
SHA256

58d6eb07e23a709a8417e4b4ea051891c41703e0bc91f52c552dc18bfebf4318
SHA512

f2fe41e147be179268a7961d7f4c562be4c43b1f32e117fea026e8db994d250e788a9db639fd15358d577914845855d618411a8617b885437051092935c377b2
SSDEEP

1536:n/iWQXD+7FxraaWzbDY3YyysxZPI4/QLKHx:QUFxraaWnDY0cVIhLQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 644	3144	regsvr32.exe	83
PID 3144 wrote to memory of 644	3144	regsvr32.exe	83
PID 3144 wrote to memory of 644	3144	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\EhStorAPI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\EhStorAPI.dll
  2⤵
  PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads