Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:41
Static task
static1
Behavioral task
behavioral1
Sample
2647032e595497e23138f556642a0e96d818ce460d950f6a192c9ab0c765f7ea.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
2647032e595497e23138f556642a0e96d818ce460d950f6a192c9ab0c765f7ea.dll
-
Size
574KB
-
MD5
21f7052e3ae7b1c50975b80aa366f3b9
-
SHA1
1ec40b45f9ecd7874647c6ef6275cefc1a000aa3
-
SHA256
2647032e595497e23138f556642a0e96d818ce460d950f6a192c9ab0c765f7ea
-
SHA512
dd6b0512ba34377e15d600e5f4236555581a9121e87d2301c2f7e6d9d4181f3bd24633a218215391347fa2be5e6fce65d471158cdfcbba68c7acd002d908a104
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1480 wrote to memory of 3412 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 3412 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 3412 1480 regsvr32.exe regsvr32.exe PID 3412 wrote to memory of 3816 3412 regsvr32.exe rundll32.exe PID 3412 wrote to memory of 3816 3412 regsvr32.exe rundll32.exe PID 3412 wrote to memory of 3816 3412 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2647032e595497e23138f556642a0e96d818ce460d950f6a192c9ab0c765f7ea.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2647032e595497e23138f556642a0e96d818ce460d950f6a192c9ab0c765f7ea.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2647032e595497e23138f556642a0e96d818ce460d950f6a192c9ab0c765f7ea.dll",DllRegisterServer3⤵