Analysis
-
max time kernel
70s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:42
Static task
static1
Behavioral task
behavioral1
Sample
cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a.dll
-
Size
574KB
-
MD5
14dbd77bcf0f638ac1413c6c3fdce4fe
-
SHA1
3dd1d6c876d5e76874bf851e079fbae56960c235
-
SHA256
cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a
-
SHA512
53e4374c1a55e6444fa30c156952fb1966b5dfc779f71596c70cb7aa0b40211adda604f7603a82ae10b480fbe71fd0ab981a88af6f406cf259155aaee9e3b0b0
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2384 wrote to memory of 2732 2384 regsvr32.exe regsvr32.exe PID 2384 wrote to memory of 2732 2384 regsvr32.exe regsvr32.exe PID 2384 wrote to memory of 2732 2384 regsvr32.exe regsvr32.exe PID 2732 wrote to memory of 2208 2732 regsvr32.exe rundll32.exe PID 2732 wrote to memory of 2208 2732 regsvr32.exe rundll32.exe PID 2732 wrote to memory of 2208 2732 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a.dll",DllRegisterServer3⤵