Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:38
Static task
static1
Behavioral task
behavioral1
Sample
99a3947314e715eb2a0fd3edfdebb29e2e3aec540a642f455709795a6b7e75b8.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
99a3947314e715eb2a0fd3edfdebb29e2e3aec540a642f455709795a6b7e75b8.dll
-
Size
574KB
-
MD5
c71d4717592d4f4a2b46e57d969b463e
-
SHA1
54d75fd12799c5ebdbb4a5a327b5877b61047dda
-
SHA256
99a3947314e715eb2a0fd3edfdebb29e2e3aec540a642f455709795a6b7e75b8
-
SHA512
b13121922808792f511d4f37e15c3b2bdd544b7569589d68ba50eb022af94d44e15c5ebd33e640fe8d3dd396d0b8eccbcb7bf193ba533782af7f1c6159b434d7
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3160 wrote to memory of 3992 3160 regsvr32.exe regsvr32.exe PID 3160 wrote to memory of 3992 3160 regsvr32.exe regsvr32.exe PID 3160 wrote to memory of 3992 3160 regsvr32.exe regsvr32.exe PID 3992 wrote to memory of 2444 3992 regsvr32.exe rundll32.exe PID 3992 wrote to memory of 2444 3992 regsvr32.exe rundll32.exe PID 3992 wrote to memory of 2444 3992 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\99a3947314e715eb2a0fd3edfdebb29e2e3aec540a642f455709795a6b7e75b8.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\99a3947314e715eb2a0fd3edfdebb29e2e3aec540a642f455709795a6b7e75b8.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\99a3947314e715eb2a0fd3edfdebb29e2e3aec540a642f455709795a6b7e75b8.dll",DllRegisterServer3⤵