3f8ec3ac729285705bbeff69bad1edada368ef5241d91d3eee878e4b0856bf52 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 21:21

Sharing

Report Analysis Logs

General

Target

泽华音乐/TrayInfo.dll
Size

40KB
MD5

3a2347459c6122c3a0fda54f5c0f01e3
SHA1

2da8d828ddc4780f8e703b3d1e009e58789cf9e2
SHA256

5558433c2eff9a42ad9027df14e7bb9899b036e4766f7ed039c6fed18bef1521
SHA512

fd4c632b13a127a365a6d78eaa747b12dd69ede3f3714cdc6e75ede62211741799eaee11f36a952d3c8361c0bf5310e84a809a27cabd63a3842e744ccb84bf0b
SSDEEP

384:/x+z8ysIv5pgKPLCt/80cwsc86R8dAN3y7lcXDAPbFHxET1d5:5+g9MpBPg/uwsXqNC7lczATFHx8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1520	2192	regsvr32.exe	28
PID 2192 wrote to memory of 1520	2192	regsvr32.exe	28
PID 2192 wrote to memory of 1520	2192	regsvr32.exe	28
PID 2192 wrote to memory of 1520	2192	regsvr32.exe	28
PID 2192 wrote to memory of 1520	2192	regsvr32.exe	28
PID 2192 wrote to memory of 1520	2192	regsvr32.exe	28
PID 2192 wrote to memory of 1520	2192	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\TrayInfo.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\TrayInfo.dll
  2⤵
  PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads