7065924119adab65e2694c4960292ef118592142666efff9df470037b7689c34 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 11:52

Sharing

Report Analysis Logs

General

Target

ICCard.dll
Size

1.6MB
MD5

9c0bdb70d190e39b14ebe79ecf3bf8d3
SHA1

53335d65c54cd02230d54475ed0408c41afd1d95
SHA256

7065924119adab65e2694c4960292ef118592142666efff9df470037b7689c34
SHA512

ca3069ee9d1334c9aab508d9506314c0c85c36b3fbe7b1d997f6b40cae100196962b7535ab1537d93c26e3a33a1c3bbddf745db322deda6b15582eca30dbd2cf
SSDEEP

49152:Up3lRs5X1QDfcMIneKmocKHffwpoEBUfdpoxPzIs61uoyOk/cHyl:IlRs5uDUMIneKmoX/YyEBUfdwIl1uoy3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1580	2180	regsvr32.exe	28
PID 2180 wrote to memory of 1580	2180	regsvr32.exe	28
PID 2180 wrote to memory of 1580	2180	regsvr32.exe	28
PID 2180 wrote to memory of 1580	2180	regsvr32.exe	28
PID 2180 wrote to memory of 1580	2180	regsvr32.exe	28
PID 2180 wrote to memory of 1580	2180	regsvr32.exe	28
PID 2180 wrote to memory of 1580	2180	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ICCard.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ICCard.dll
  2⤵
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads