48a2db38aba347d0f611cac788d63cc612bbb5cee9b2109a18525e84923040db | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 13:46

Sharing

Report Analysis Logs

General

Target

PEngine.dll
Size

1.8MB
MD5

b955e54c67328b1825a7dbfdfbe04e8c
SHA1

5f00aad634838e736fafc57eecb80d9b3e8f3083
SHA256

5f247d15241477e0a4efef25bb2faabdee2aa6a299e6693d830453026d29d7be
SHA512

7c45514a0d5e241817be6041fd2722f23dc5c2fe2d6c61980f2a2a126c9ef1a240be8cba58d303299ebddb3d74385e14bd4e58439e7e77c9578b0a81a8dff314
SSDEEP

49152:SndEJDuCJ6x8WRqYIdNUyJdWYjR0Sb71wA9x:Sn29uuxjRl1X

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2340	1876	regsvr32.exe	31
PID 1876 wrote to memory of 2340	1876	regsvr32.exe	31
PID 1876 wrote to memory of 2340	1876	regsvr32.exe	31
PID 1876 wrote to memory of 2340	1876	regsvr32.exe	31
PID 1876 wrote to memory of 2340	1876	regsvr32.exe	31
PID 1876 wrote to memory of 2340	1876	regsvr32.exe	31
PID 1876 wrote to memory of 2340	1876	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PEngine.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\PEngine.dll
  2⤵
  PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads