Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-11-2020 11:08
Static task
static1
Behavioral task
behavioral1
Sample
e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll
-
Size
282KB
-
MD5
736cbf4e5d86772965db0b0ed4e4b9e2
-
SHA1
c2701cfc2a650dfee8b5615216d161629662f9b3
-
SHA256
e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33
-
SHA512
7dccb38ed0c9662a2456a115921d3620efc387b59f22c30e3af870835b5aff15f1d20507403e1c5c97622cd9a379a847b458e073489fae886e4b35b619f48eab
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4684 wrote to memory of 4832 4684 regsvr32.exe regsvr32.exe PID 4684 wrote to memory of 4832 4684 regsvr32.exe regsvr32.exe PID 4684 wrote to memory of 4832 4684 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e61c59b4c439efa60a4dcf594c9169a0654eb88d8572a3a347de1fc76678bd33.dll2⤵