f7c00eabd86e1ad0eed7a4ae0d46d122125d9d77f9bef0b04496bbeb633925b9 | Triage

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 06:48

Sharing

Report Analysis Logs

General

Target

Anti-WPA-3-4-6/AMD64/antiwpa.dll
Size

9KB
MD5

7e2bee1aef75af92daaac01d4cfee7e5
SHA1

b252babfaf24824e132b32683ae548be9dd69a36
SHA256

e1aaba5d75b2ace11713679e557ca0c67bf2586fa2a75bff4cfab4f8fc9b3d6a
SHA512

1a9407be6660a30e9ca9aa94a9090122e022b02113decf7dea578b3cb5a5694a329c9f63d2349c1f691e2a36e86bc27f7a3041d5326c194086f79993c9f68149
SSDEEP

192:c1OMn3ROZfm0Fy16ZlRWh8yDRJasyTAzJf:cXn3Rn0o16Zl0h8ydIQJf

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\antiwpa.dll	regsvr32.exe
File created	C:\Windows\system32\antiwpa.dll	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 1752	724	regsvr32.exe	82
PID 724 wrote to memory of 1752	724	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Anti-WPA-3-4-6\AMD64\antiwpa.dll
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" setupapi,InstallHinfSection DEL_OOBE_ACTIVATE 132 syssetup.inf
  2⤵
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/724-0-0x0000000005000000-0x0000000005003000-memory.dmp

Filesize
12KB

Download
memory/724-1-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download