Analysis
-
max time kernel
114s -
max time network
117s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll
-
Size
574KB
-
MD5
dab114e46255fe871f570cbf62ba8db5
-
SHA1
cf36ae8d18749eb72772d6537fb90d458f551270
-
SHA256
5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86
-
SHA512
7a3d5a00ae7c1a84848eb57b01296e055c5b49d2845e4db4a7b25319a2f976e74ee6dddc06d77545cb0cdf70d26339651829fba7c3ac375ba2cd1b2d21a07446
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3732 wrote to memory of 3320 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 3320 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 3320 3732 regsvr32.exe regsvr32.exe PID 3320 wrote to memory of 3524 3320 regsvr32.exe rundll32.exe PID 3320 wrote to memory of 3524 3320 regsvr32.exe rundll32.exe PID 3320 wrote to memory of 3524 3320 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5deda744d50ba76e8cde8f0d7737402e4d8f46f22952119dc00aec1c928d8f86.dll",DllRegisterServer3⤵