1743c09774c8aa85ea6463bf48def681e4ccf13660620e7378ecd9df6c33169b | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 16:37

Sharing

Report Analysis Logs

General

Target

Fish-v327-0221/mfc42.dll
Size

1.1MB
MD5

74c76bb54b26ce50c4bc755f92687c63
SHA1

3c13dacdea9b588477b76c395e2223185e064308
SHA256

7dd3d4a6898f5c0fc3b6bbeb1556f48cc4f7e599d9b63f5f04231b3ca8a7922a
SHA512

90103fa6fdae3b871057e2764ae9b9dcbda556d11088b378e23a97775946cd7e8bb16171b558e8d475f0c5aa4dad5969b0e1146759449824e628dda7eae6135f
SSDEEP

24576:TuerM6WEuv3OZEB05Bp8NhVjJBHbtbajNzbcpsa9G4b1Tm:LrM6WEuvtB0+9jjHbCcPb1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2984	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2984	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2984	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2984	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2984	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2984	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2984	1688	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\mfc42.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\mfc42.dll
  2⤵
  PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads