621016df8128bb8db8c068ac97195e6ea7456d22aecb94c5254fd667d76dd7ea | Triage

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 05:40

Sharing

Report Analysis Logs

General

Target

regclr.dll
Size

178KB
MD5

c0a56dda7e28d2f5a9277602d429e1b7
SHA1

4fec12f6c384ed443ac6b01c88027738599eb43e
SHA256

dcd60c98e4e14bbcd8d3c02dd4c12f5750dc2a0ddf4108721b980158a3df4821
SHA512

f495ce35a61d148f425180bed96b96d68923ef8f18729a742a22a1d03a0d46147b9294276e0b9e32f8490bf37a24157423887b742231d6f87192d6ed9aff32c8
SSDEEP

3072:EgYtk3Op0+0hoL7mGlIUp3u7Li7XeWtppMLhJcsJneGI3yti7J5elGE:hcpEhrGlIUp3u7qMLosRe3ytk6lGE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 4580	612	rundll32.exe	82
PID 612 wrote to memory of 4580	612	rundll32.exe	82
PID 612 wrote to memory of 4580	612	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\regclr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\regclr.dll,#1
  2⤵
  PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads