aadc6fdfee6900ee54dfa37d0991a1cac05473cc5b80f0865603bc0a7eb51211 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 11:41

Sharing

Report Analysis Logs

General

Target

DTSPipelinePerf140.dll
Size

41KB
MD5

a70c74a103bf8bc438cb8e56e2b8383a
SHA1

b4ae65aeb2be2bdfb5c2e6355c2bf42daf697be3
SHA256

aadc6fdfee6900ee54dfa37d0991a1cac05473cc5b80f0865603bc0a7eb51211
SHA512

0f88a471130a6d3ed3185ce6b3864cf4ac629e8644af792be757711b47ef71caf9a6710cad7a5b5e198edcec6f5c1ce8a22bd6205101cf283e07c71e47576ccf
SSDEEP

768:JYdINyU04vpuNO1jAkgREbdJeOovZofxmmo47i67R6bPG:J2INy74wNhtREb3ovifxmmb77sbPG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2008	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2008	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2008	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2008	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2008	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2008	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2008	2972	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DTSPipelinePerf140.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DTSPipelinePerf140.dll
  2⤵
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads