3f8ec3ac729285705bbeff69bad1edada368ef5241d91d3eee878e4b0856bf52 | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 21:21

Sharing

Report Analysis Logs

General

Target

泽华音乐/Diag.dll
Size

137KB
MD5

b73809a916e6d7c1ae56f182a2e8f7e2
SHA1

34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
SHA256

64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
SHA512

26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
SSDEEP

3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 4500	3764	regsvr32.exe	81
PID 3764 wrote to memory of 4500	3764	regsvr32.exe	81
PID 3764 wrote to memory of 4500	3764	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\Diag.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\Diag.dll
  2⤵
  PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads