Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
05-11-2021 17:06
Static task
static1
Behavioral task
behavioral1
Sample
3fd510a3.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3fd510a3.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
-
Target
3fd510a3.dll
-
Size
790KB
-
MD5
65c320bc5258d8fa86aa9ffd876291d3
-
SHA1
f0215aac7be36a5fedeea51d34d8f8da2e98bf1b
-
SHA256
3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f
-
SHA512
897f7d24f6d9a53506ee73aaf692b8293906e1f1fe13539e6d3f88fb8bafa0467632233f2b0e5a2ee1de686667c8d10a6c07f27559ff0f0a382a073e71e575e6
Score
10/10
Malware Config
Signatures
-
Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4048 wrote to memory of 1900 4048 regsvr32.exe regsvr32.exe PID 4048 wrote to memory of 1900 4048 regsvr32.exe regsvr32.exe PID 4048 wrote to memory of 1900 4048 regsvr32.exe regsvr32.exe