Analysis
-
max time kernel
44s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
31-03-2021 01:55
Static task
static1
Behavioral task
behavioral1
Sample
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll
-
Size
619KB
-
MD5
a467c5e63940b8bc9b56f382aa20ea94
-
SHA1
eac1e8911a5fced479130bd8c7382aa6cb3278c9
-
SHA256
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf
-
SHA512
2bf61eb3264e2171cb4dad95018ac5dca826950821f5b8c8a1399bac6fe55dab258fd54f12f3d3c83039ce37b43f292fefc02082010f102a26e86bccc04a1ce9
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 652 wrote to memory of 1572 652 regsvr32.exe regsvr32.exe PID 652 wrote to memory of 1572 652 regsvr32.exe regsvr32.exe PID 652 wrote to memory of 1572 652 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll1⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll2⤵PID:1572