b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 08:52

Sharing

Report Analysis Logs

General

Target

MBContainer.dll
Size

204KB
MD5

025dad5638a76d852cf500b24656af2d
SHA1

4ff70d318d09d146b2ecca119a0ce755fe86827a
SHA256

da1571304d19788efad715c40820b0eb22de4076a0357f81cf17f3e596596c75
SHA512

e07ba5120d3e248b0861e9d1be3545a5a6499bb16f5eecf15b98c03da180381bca2718e73bb2769d807a07a6ed2c7b85012526665dd6b33384f50a121c61431e
SSDEEP

6144:jr9I1KoNMtEtCaQ8kUTMKkcqwqxg0O1+O:v9oKoCOtpfkSqxg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2128	2956	regsvr32.exe	30
PID 2956 wrote to memory of 2128	2956	regsvr32.exe	30
PID 2956 wrote to memory of 2128	2956	regsvr32.exe	30
PID 2956 wrote to memory of 2128	2956	regsvr32.exe	30
PID 2956 wrote to memory of 2128	2956	regsvr32.exe	30
PID 2956 wrote to memory of 2128	2956	regsvr32.exe	30
PID 2956 wrote to memory of 2128	2956	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MBContainer.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MBContainer.dll
  2⤵
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads