3f8ec3ac729285705bbeff69bad1edada368ef5241d91d3eee878e4b0856bf52 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 21:21

Sharing

Report Analysis Logs

General

Target

泽华音乐/SysTray.dll
Size

40KB
MD5

b7d9fd13383422cde37c58e1f4816a6a
SHA1

98591490a342685b82dac21def58bb50de8552a4
SHA256

337d63f0d2bb3d3d5ce1e231bfc0f353806c5271bbba1b74f163c8ec589ba648
SHA512

9442c50eacc45a0351281473488bb8bd5065e3433cc7968860f3df314633ce68779b1ec4861e9c0292e3861a51a23ce4b89a40cc57f3dffec8b9baf2cab36047
SSDEEP

384:nqNy4KesNv5pgKPLCt/80lMo70Dd8t4hz27lc/DAP4FHxEz1tgk:nqNEZTpBPg/HMo7+h67lcLAAFHxhk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1228	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1228	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1228	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1228	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1228	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1228	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1228	1680	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\SysTray.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\SysTray.dll
  2⤵
  PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads