958e98cd981e7b8c9ed4253cdd098e03c5bf2cc5ce8ff146cbc7eadfc7e05406 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 13:09

Sharing

Report Analysis Logs

General

Target

AppxSip.dll
Size

93KB
MD5

3a91ae889f89fb8178f83ed516e58007
SHA1

d07f7a2213a7345fe561da4e3a91aee778b03798
SHA256

958e98cd981e7b8c9ed4253cdd098e03c5bf2cc5ce8ff146cbc7eadfc7e05406
SHA512

1e1082460b9987d73ec5444afa23f96f70427f79d68769161e853b0b9cfdfa02b7b5c6889c20726652e1dd3aa13bdd3b239f82a06303bd75b802b8896bfc60d4
SSDEEP

1536:nMXD1qNcTJVmH7REratw5bJyR8lvK1DTnpofc3c:nMXD0YmFl1wvEvpoE3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1720	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1720	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1720	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1720	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1720	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1720	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1720	1676	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppxSip.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AppxSip.dll
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads