3f8ec3ac729285705bbeff69bad1edada368ef5241d91d3eee878e4b0856bf52 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 21:21

Sharing

Report Analysis Logs

General

Target

泽华音乐/SysTray.dll
Size

40KB
MD5

b7d9fd13383422cde37c58e1f4816a6a
SHA1

98591490a342685b82dac21def58bb50de8552a4
SHA256

337d63f0d2bb3d3d5ce1e231bfc0f353806c5271bbba1b74f163c8ec589ba648
SHA512

9442c50eacc45a0351281473488bb8bd5065e3433cc7968860f3df314633ce68779b1ec4861e9c0292e3861a51a23ce4b89a40cc57f3dffec8b9baf2cab36047
SSDEEP

384:nqNy4KesNv5pgKPLCt/80lMo70Dd8t4hz27lc/DAP4FHxEz1tgk:nqNEZTpBPg/HMo7+h67lcLAAFHxhk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 732	4052	regsvr32.exe	82
PID 4052 wrote to memory of 732	4052	regsvr32.exe	82
PID 4052 wrote to memory of 732	4052	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\SysTray.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\SysTray.dll
  2⤵
  PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads