b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:52

Sharing

Report Analysis Logs

General

Target

MCore.dll
Size

1.4MB
MD5

dd9b2f849bc8210dfb9bed67aa433edd
SHA1

eda719f5411636125c4796809862ee89e0aace11
SHA256

be85fe280236828186a7f3dbe4f8cdd1bbd8e3fa4c78f3dbea01fe8c14660b33
SHA512

70cc2da89a86eb8287f407bfd689df450b3478881519a17e04d016be197588b1c43fabd0de45f48d7f0a8dca87cc90a4930771a32d8054ff950c06e0a112fa05
SSDEEP

24576:4SYQgoGW6aW7/7Whc/9feo0YCwPqoic3you:RoLW6aW7P/9Go7Csnvyou

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1016	1316	regsvr32.exe	31
PID 1316 wrote to memory of 1016	1316	regsvr32.exe	31
PID 1316 wrote to memory of 1016	1316	regsvr32.exe	31
PID 1316 wrote to memory of 1016	1316	regsvr32.exe	31
PID 1316 wrote to memory of 1016	1316	regsvr32.exe	31
PID 1316 wrote to memory of 1016	1316	regsvr32.exe	31
PID 1316 wrote to memory of 1016	1316	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MCore.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MCore.dll
  2⤵
  PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads