55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4 | Triage

Analysis

max time kernel
315s
max time network
396s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30/05/2024, 09:46

Sharing

Report Analysis Logs

General

Target

$SYSDIR/CFCA_HSBC_scsp.dll
Size

45KB
MD5

59671bf95699f5fd4ad23e6da2bd6284
SHA1

d50f9d1cdbaacabb86fb6106e98fff084e9ca9f5
SHA256

011523f383fe08bcd5a07307fc76cb644d6d7e955a88fdea02473a7591858386
SHA512

b7abb03eb4c2b395fc48679421668cf9ddd164c3b23d641b8631a97df0031133b5d8ea2102efdc0e07b881ebfe1668c0c4a3102ab6897e56ba734306ab01ecbc
SSDEEP

768:3Ai/JwobqOtAHbhgSFmXEI1iogdq0S01/2o+6JKKFx:wK+mLBJ1iDduaJp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1160	5116	regsvr32.exe	73
PID 5116 wrote to memory of 1160	5116	regsvr32.exe	73
PID 5116 wrote to memory of 1160	5116	regsvr32.exe	73

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_scsp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_scsp.dll
  2⤵
  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads