Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:42
Static task
static1
Behavioral task
behavioral1
Sample
85351dbac3d56c1b994aa02a9e1d453366a237ac81e898a8aab762bb765a5962.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
85351dbac3d56c1b994aa02a9e1d453366a237ac81e898a8aab762bb765a5962.dll
-
Size
574KB
-
MD5
fb6f55eddc512ce00aebb1d046f36b92
-
SHA1
7105d8ea3c4d6bdb30b3f5732525dc119187bec8
-
SHA256
85351dbac3d56c1b994aa02a9e1d453366a237ac81e898a8aab762bb765a5962
-
SHA512
f2db9932db0bf4edb289ce6189916920b5bcdb3c728b98dd96b09b8e2cfd7745c007bee80a35e9f318d054f320a4963bacbb07cadc860b8de81d50e30c165b26
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2424 wrote to memory of 2512 2424 regsvr32.exe regsvr32.exe PID 2424 wrote to memory of 2512 2424 regsvr32.exe regsvr32.exe PID 2424 wrote to memory of 2512 2424 regsvr32.exe regsvr32.exe PID 2512 wrote to memory of 3068 2512 regsvr32.exe rundll32.exe PID 2512 wrote to memory of 3068 2512 regsvr32.exe rundll32.exe PID 2512 wrote to memory of 3068 2512 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\85351dbac3d56c1b994aa02a9e1d453366a237ac81e898a8aab762bb765a5962.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\85351dbac3d56c1b994aa02a9e1d453366a237ac81e898a8aab762bb765a5962.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\85351dbac3d56c1b994aa02a9e1d453366a237ac81e898a8aab762bb765a5962.dll",DllRegisterServer3⤵