09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85 | Triage

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:01

Sharing

Report Analysis Logs

General

Target

Bull140U.dll
Size

3.2MB
MD5

b5ac5913784d34c843677547edd5c578
SHA1

ed2a4e165ad8b65b1699aaf048654142a66943c6
SHA256

3267244255376bfaf68e75ad38468ba3ca0bbb49fe260f6e05611148d5cee3c9
SHA512

28a29ff02d7ce6d6a74b4938a1a1388c4ad6b36600bc9e7664edf14eb8a89aee49c107c46e13aee0194a38ec506cd86094952ce9327d724a98541871ff58d6db
SSDEEP

49152:YucCrMCcHiNTP0aVY+cTiPA+uo8TWp1gbuDIc7TYgZwnlmd2:neCtVYfbnoQbhPn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2204	2056	regsvr32.exe	31
PID 2056 wrote to memory of 2204	2056	regsvr32.exe	31
PID 2056 wrote to memory of 2204	2056	regsvr32.exe	31
PID 2056 wrote to memory of 2204	2056	regsvr32.exe	31
PID 2056 wrote to memory of 2204	2056	regsvr32.exe	31
PID 2056 wrote to memory of 2204	2056	regsvr32.exe	31
PID 2056 wrote to memory of 2204	2056	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads