e66d33caff1a5048e4a5b05e52de6b92957aadd9663265afe495965f9769a725 | Triage

Analysis

max time kernel
132s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$_2_/TNProxy.dll
Size

377KB
MD5

858fc685a5bff591985394f9cdf9e289
SHA1

5970a28aab399d005885b9c6b79eafd606640fab
SHA256

3404212366a3aed4155e5d73d901e769a7005cadde5169a8d9677ab5a0585dcf
SHA512

620491b27ff281ad42f947fb9dbef3256624fe8d298740d6b9942627525a2d44525cbb9065d2ffa2efb0ab3478b8a33148fc9b0b4c531106cc8e421e2c59f0d0
SSDEEP

6144:H9u5ec95CL2ADz5izTNe/rCkMyELlc5VZ7ciL3QSGV0G/34r:NczXTNe/rCdVLlMNcW3Q3E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1092	764	regsvr32.exe	82
PID 764 wrote to memory of 1092	764	regsvr32.exe	82
PID 764 wrote to memory of 1092	764	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_2_\TNProxy.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$_2_\TNProxy.dll
  2⤵
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads