f7c00eabd86e1ad0eed7a4ae0d46d122125d9d77f9bef0b04496bbeb633925b9 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 06:48

Sharing

Report Analysis Logs

General

Target

Anti-WPA-3-4-6/AMD64/antiwpa.dll
Size

9KB
MD5

7e2bee1aef75af92daaac01d4cfee7e5
SHA1

b252babfaf24824e132b32683ae548be9dd69a36
SHA256

e1aaba5d75b2ace11713679e557ca0c67bf2586fa2a75bff4cfab4f8fc9b3d6a
SHA512

1a9407be6660a30e9ca9aa94a9090122e022b02113decf7dea578b3cb5a5694a329c9f63d2349c1f691e2a36e86bc27f7a3041d5326c194086f79993c9f68149
SSDEEP

192:c1OMn3ROZfm0Fy16ZlRWh8yDRJasyTAzJf:cXn3Rn0o16Zl0h8ydIQJf

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\antiwpa.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\antiwpa.dll	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2696	2640	regsvr32.exe	30
PID 2640 wrote to memory of 2696	2640	regsvr32.exe	30
PID 2640 wrote to memory of 2696	2640	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Anti-WPA-3-4-6\AMD64\antiwpa.dll
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" setupapi,InstallHinfSection DEL_OOBE_ACTIVATE 132 syssetup.inf
  2⤵
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-2-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/2640-1-0x0000000005000000-0x0000000005003000-memory.dmp

Filesize
12KB

Download