Analysis
-
max time kernel
84s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
0522d14be416f1bbe2f7c05f9553294a87dc0f387336cc5649e312ac567398e1.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
0522d14be416f1bbe2f7c05f9553294a87dc0f387336cc5649e312ac567398e1.dll
-
Size
574KB
-
MD5
a93e323c015735e3224b3cee872d6298
-
SHA1
b98fa38356b94e4bdb9f44c7b80528a8185da0dc
-
SHA256
0522d14be416f1bbe2f7c05f9553294a87dc0f387336cc5649e312ac567398e1
-
SHA512
a6de72a7b593a476e342f77dd082ad2ed63b2cbdd17f47380665b9d67a40631d6a3a9c249524e10c405c8d5da3c202407a6c0f25581e8d67ccf3acb156ae737a
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2448 wrote to memory of 912 2448 regsvr32.exe regsvr32.exe PID 2448 wrote to memory of 912 2448 regsvr32.exe regsvr32.exe PID 2448 wrote to memory of 912 2448 regsvr32.exe regsvr32.exe PID 912 wrote to memory of 1324 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 1324 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 1324 912 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0522d14be416f1bbe2f7c05f9553294a87dc0f387336cc5649e312ac567398e1.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0522d14be416f1bbe2f7c05f9553294a87dc0f387336cc5649e312ac567398e1.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0522d14be416f1bbe2f7c05f9553294a87dc0f387336cc5649e312ac567398e1.dll",DllRegisterServer3⤵