Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:37
Static task
static1
Behavioral task
behavioral1
Sample
2c64f883ad89b892133f031c46d79d9a7bf5074ce4fe707fb34570242cf36f5e.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
2c64f883ad89b892133f031c46d79d9a7bf5074ce4fe707fb34570242cf36f5e.dll
-
Size
574KB
-
MD5
c9ec275fbc0a5414ada5b511ac6239d3
-
SHA1
9982a082be37ad2ac2651928c3a7c26a613a0d32
-
SHA256
2c64f883ad89b892133f031c46d79d9a7bf5074ce4fe707fb34570242cf36f5e
-
SHA512
3ce2b93af578d25968337c2b38b602ae6395a9399101570128cc6052da099fd581a403ffe1978adec46b17dd65888e0761869fc7d001e1640a5bcbff88c802b6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2656 wrote to memory of 2712 2656 regsvr32.exe regsvr32.exe PID 2656 wrote to memory of 2712 2656 regsvr32.exe regsvr32.exe PID 2656 wrote to memory of 2712 2656 regsvr32.exe regsvr32.exe PID 2712 wrote to memory of 3048 2712 regsvr32.exe rundll32.exe PID 2712 wrote to memory of 3048 2712 regsvr32.exe rundll32.exe PID 2712 wrote to memory of 3048 2712 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2c64f883ad89b892133f031c46d79d9a7bf5074ce4fe707fb34570242cf36f5e.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2c64f883ad89b892133f031c46d79d9a7bf5074ce4fe707fb34570242cf36f5e.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2c64f883ad89b892133f031c46d79d9a7bf5074ce4fe707fb34570242cf36f5e.dll",DllRegisterServer3⤵