Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:42
Static task
static1
Behavioral task
behavioral1
Sample
4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll
Resource
win10-en-20211208
General
-
Target
4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll
-
Size
574KB
-
MD5
e6a764852dc8e94d3c07889f0bda6687
-
SHA1
b2383f99ba3c5f4447b6cc0e5e031d45c6660ee0
-
SHA256
4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38
-
SHA512
2192986bcc2c2713b856cff58185fb97db3c9af412e4393b8efa21d4a7693623c794af54aed6c9650bebd7a209c9acab34270c862c3f5187d5841030c4c2f5a4
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1908 wrote to memory of 3732 1908 regsvr32.exe regsvr32.exe PID 1908 wrote to memory of 3732 1908 regsvr32.exe regsvr32.exe PID 1908 wrote to memory of 3732 1908 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 4036 3732 regsvr32.exe rundll32.exe PID 3732 wrote to memory of 4036 3732 regsvr32.exe rundll32.exe PID 3732 wrote to memory of 4036 3732 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4be410222a664f3f991f339a9d01d7e582b633b9d97ea3e3c97c25ece0a2ec38.dll",DllRegisterServer3⤵