d7d47aa5796cad499374b284e865f715e7496efca16566add1c3a505730259de | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 06:48

Sharing

Report Analysis Logs

General

Target

kisupco.dll
Size

313KB
MD5

98fc1aad0bbfb1905eaace38830c4833
SHA1

530c78e4a6b6658502813f91fd981a1c094c08eb
SHA256

df8916c996286c59475b93e50c6471236b12d8a64f2f079d773b8b5224fe0aa7
SHA512

170472986a405a412b527a34643d52f984f76bc3ccb6feb732a2943bf26743be2e35805bae26d00858a2ce1c9e302c9b679ec2b92309ab4d043212d1cf1f8797
SSDEEP

6144:nYL+rabxjGEL7zvrAfzZ+bV5HEZFx97vCzMels:nYLUsGELHvrkzZ+x5kZFxpgls

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2100	2112	regsvr32.exe	28
PID 2112 wrote to memory of 2100	2112	regsvr32.exe	28
PID 2112 wrote to memory of 2100	2112	regsvr32.exe	28
PID 2112 wrote to memory of 2100	2112	regsvr32.exe	28
PID 2112 wrote to memory of 2100	2112	regsvr32.exe	28
PID 2112 wrote to memory of 2100	2112	regsvr32.exe	28
PID 2112 wrote to memory of 2100	2112	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kisupco.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kisupco.dll
  2⤵
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads