4691b5820190679e577d8c7a0967e3328e1448ac8292de87b603cd9afe200364 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:28

Sharing

Report Analysis Logs

General

Target

Spoofer/PenImc_cor3.dll
Size

142KB
MD5

f9ee4ec354ae7cee61b8a5011b20f450
SHA1

c0faa927690b0d3f204735a23f6a1044841d57f6
SHA256

02a806665f25402ef11ef4400b881323ac1a590ad24cf5719753635d1d34a59c
SHA512

6fe70c3fe2f1c7de36c04e929480bcfdc2445188bbe1109ea0f3fcd18f216a89dab5676427ac6ca36bf17ecf47c81c9fa7bfec46af6efd796d971eaef17eb9da
SSDEEP

3072:Phf6p/wTy9ETn7txZFKgStx1Tna+vY4St3iLjk:U+7tdK/tblah

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2328 wrote to memory of 2176	2328	regsvr32.exe	regsvr32.exe
PID 2328 wrote to memory of 2176	2328	regsvr32.exe	regsvr32.exe
PID 2328 wrote to memory of 2176	2328	regsvr32.exe	regsvr32.exe
PID 2328 wrote to memory of 2176	2328	regsvr32.exe	regsvr32.exe
PID 2328 wrote to memory of 2176	2328	regsvr32.exe	regsvr32.exe
PID 2328 wrote to memory of 2176	2328	regsvr32.exe	regsvr32.exe
PID 2328 wrote to memory of 2176	2328	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Spoofer\PenImc_cor3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Spoofer\PenImc_cor3.dll
2⤵
PID:2176

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...