Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:37
Static task
static1
Behavioral task
behavioral1
Sample
321421b2acf57e92bf58d922e61c48664caa9918e20ea00147c72e64382f09c5.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
321421b2acf57e92bf58d922e61c48664caa9918e20ea00147c72e64382f09c5.dll
-
Size
574KB
-
MD5
3e8044dd0c0b647df8ee4ad96883d27d
-
SHA1
92e1b88a9eda9ab3568525857cdb62ffeade0105
-
SHA256
321421b2acf57e92bf58d922e61c48664caa9918e20ea00147c72e64382f09c5
-
SHA512
66e50dbde769bb1b13d0b3bbc05c65f500d575e1a23d4fa0f32d0c69cd6f4ce8e3bc2b9f3b9a4d9a07ef4b84f60bb2ca23f3205af3f15d7f1512fa7efed374c8
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 712 wrote to memory of 832 712 regsvr32.exe regsvr32.exe PID 712 wrote to memory of 832 712 regsvr32.exe regsvr32.exe PID 712 wrote to memory of 832 712 regsvr32.exe regsvr32.exe PID 832 wrote to memory of 3088 832 regsvr32.exe rundll32.exe PID 832 wrote to memory of 3088 832 regsvr32.exe rundll32.exe PID 832 wrote to memory of 3088 832 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\321421b2acf57e92bf58d922e61c48664caa9918e20ea00147c72e64382f09c5.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\321421b2acf57e92bf58d922e61c48664caa9918e20ea00147c72e64382f09c5.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\321421b2acf57e92bf58d922e61c48664caa9918e20ea00147c72e64382f09c5.dll",DllRegisterServer3⤵