773a2e2f589b1f938b17ba80a17d0084f80e778e6e13659e344c2c0e498c25d0 | Triage

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:33

Sharing

Report Analysis Logs

General

Target

DMAlertListener.ProxyStub.dll
Size

7KB
MD5

d23307f56bf92c9089ff45e239b5a3cf
SHA1

58483616b0ddeb93b90d354bc6306defd103d333
SHA256

773a2e2f589b1f938b17ba80a17d0084f80e778e6e13659e344c2c0e498c25d0
SHA512

c067cc955da7a84ece8b2bf783a1ff73a994ea1958128e589a92306530f772e92179555baefab7da9a67d4fa08e457c1a5b56cfc8da4199892517f59437aae0f
SSDEEP

96:C9PlhQfZgXlVICDEaOoAelrC/zTiwEW3vyWw:C9Plhii1VhDPAelrC/zTyWfyW

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DC25420-C66D-44B5-B3D3-78EECFFA6DB0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DC25420-C66D-44B5-B3D3-78EECFFA6DB0}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2596A876-8BA6-45C0-A7F4-76624F5E0F47}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2596A876-8BA6-45C0-A7F4-76624F5E0F47}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2596A876-8BA6-45C0-A7F4-76624F5E0F47}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 2164	428	regsvr32.exe	82
PID 428 wrote to memory of 2164	428	regsvr32.exe	82
PID 428 wrote to memory of 2164	428	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DMAlertListener.ProxyStub.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DMAlertListener.ProxyStub.dll
  2⤵
  - Modifies registry class
  PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads