7d7ee0e33727d9db6fe70aaf56f3e4ecea1a7a01e4880586384e25ab07e3927d | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:37

Sharing

Report Analysis Logs

General

Target

$_61_.dll
Size

172KB
MD5

d344cc84609a807ce92187c9662d392b
SHA1

8531c2fb7d1e749a90a2b940bf53a40d089ed421
SHA256

3b2c33bacfe50cb378daf5d06f84de603ab5569232224ecc942f2e779702eef5
SHA512

a722e757a75ded6359c4e31b4aa21be0d60289a97eb401c58db9cf8ff9a4402e068fbf15ad068597f44f751fa6a502b4493ad2ec4b5a60111c7a7d09bf2cbd3c
SSDEEP

3072:CdF1aM/cjQATw36OidOmFuZcDhohRrZH4JN75oPaXQaJRK1ZNf:KFKFvRFu6Dhox4O2W7Nf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2368	2272	regsvr32.exe	31
PID 2272 wrote to memory of 2368	2272	regsvr32.exe	31
PID 2272 wrote to memory of 2368	2272	regsvr32.exe	31
PID 2272 wrote to memory of 2368	2272	regsvr32.exe	31
PID 2272 wrote to memory of 2368	2272	regsvr32.exe	31
PID 2272 wrote to memory of 2368	2272	regsvr32.exe	31
PID 2272 wrote to memory of 2368	2272	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_61_.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$_61_.dll
  2⤵
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads