29e7cdc8660c96b05630f5a66fbbc9e9aca7fbf4f5cb1517a954e3dfd252511d | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

零时空/cl32.dll
Size

889KB
MD5

d487152d86d0ab5c8ef294ca737afce6
SHA1

b76572e6b083c2c3f48b5924a1db77704845a91f
SHA256

d240c6514f2777aee7a0767412b350e5616476f2edd5c27352500e1f172b010a
SHA512

adcf8dd79cd9204108182ec45999a22cfebec2d33106eafedef8333e8ea53ae4f9544f592479f7c6e280d14d20ba460217867c972694fd64442405a12673ffcc
SSDEEP

24576:w7zxqgV7iurHp/HG52xulNEJnN01NIybLO2k:gVqvsHp/HGjlCR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 776	2032	regsvr32.exe	84
PID 2032 wrote to memory of 776	2032	regsvr32.exe	84
PID 2032 wrote to memory of 776	2032	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\零时空\cl32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\零时空\cl32.dll
  2⤵
  PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads