09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85 | Triage

Analysis

max time kernel
137s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 11:54

Sharing

Report Analysis Logs

General

Target

Bull140U.dll
Size

3.2MB
MD5

b5ac5913784d34c843677547edd5c578
SHA1

ed2a4e165ad8b65b1699aaf048654142a66943c6
SHA256

3267244255376bfaf68e75ad38468ba3ca0bbb49fe260f6e05611148d5cee3c9
SHA512

28a29ff02d7ce6d6a74b4938a1a1388c4ad6b36600bc9e7664edf14eb8a89aee49c107c46e13aee0194a38ec506cd86094952ce9327d724a98541871ff58d6db
SSDEEP

49152:YucCrMCcHiNTP0aVY+cTiPA+uo8TWp1gbuDIc7TYgZwnlmd2:neCtVYfbnoQbhPn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2544 wrote to memory of 4852	2544	regsvr32.exe	regsvr32.exe
PID 2544 wrote to memory of 4852	2544	regsvr32.exe	regsvr32.exe
PID 2544 wrote to memory of 4852	2544	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
2⤵
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...