7d7ee0e33727d9db6fe70aaf56f3e4ecea1a7a01e4880586384e25ab07e3927d | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:37

Sharing

Report Analysis Logs

General

Target

$_71_.dll
Size

4.0MB
MD5

e56349da176df943885053367da2e539
SHA1

1b279991969dfb1db2b039900503446d0e2cb13f
SHA256

845dd0a0bcbe7b5bd58371c183621ca3bd558ce5798d87e5bb7a56e70300a310
SHA512

70b2633b9afca366c4c2ab5377b9441ad6c23637090599ebe86de6d11d849f1daf5c7c0c6c182c7568654c01a36ba6d32899d36191a42df476b220d12e190537
SSDEEP

49152:KWBQmJdIadQGz+ueYT6zPo7RtwGdSLHaQ2gzVQMrd/yBSaB921QuKHvR:KWBHJdxVCJYT6zPCRtwGd2yBRZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1396	2524	regsvr32.exe	30
PID 2524 wrote to memory of 1396	2524	regsvr32.exe	30
PID 2524 wrote to memory of 1396	2524	regsvr32.exe	30
PID 2524 wrote to memory of 1396	2524	regsvr32.exe	30
PID 2524 wrote to memory of 1396	2524	regsvr32.exe	30
PID 2524 wrote to memory of 1396	2524	regsvr32.exe	30
PID 2524 wrote to memory of 1396	2524	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_71_.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$_71_.dll
  2⤵
  PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads