Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:49
Static task
static1
Behavioral task
behavioral1
Sample
683a5371a4590d637f08b776d7bcedbf36ff9bf7b3e80c6a81266039414cfac2.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
683a5371a4590d637f08b776d7bcedbf36ff9bf7b3e80c6a81266039414cfac2.dll
-
Size
574KB
-
MD5
5c8b570a97fd647c7596c018b69b12ed
-
SHA1
f18a33cb90f373805f2556d4bc24224adc5c7773
-
SHA256
683a5371a4590d637f08b776d7bcedbf36ff9bf7b3e80c6a81266039414cfac2
-
SHA512
b65bb4a63cdffa9039114c19d0e878e4a77c8a24016922aecbab1024f8ef336aab7f987c07726d4eb0951e11f6ed327d9f1893051a7d31c8ca59ca2aa10e6617
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2504 wrote to memory of 2540 2504 regsvr32.exe regsvr32.exe PID 2504 wrote to memory of 2540 2504 regsvr32.exe regsvr32.exe PID 2504 wrote to memory of 2540 2504 regsvr32.exe regsvr32.exe PID 2540 wrote to memory of 3012 2540 regsvr32.exe rundll32.exe PID 2540 wrote to memory of 3012 2540 regsvr32.exe rundll32.exe PID 2540 wrote to memory of 3012 2540 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\683a5371a4590d637f08b776d7bcedbf36ff9bf7b3e80c6a81266039414cfac2.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\683a5371a4590d637f08b776d7bcedbf36ff9bf7b3e80c6a81266039414cfac2.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\683a5371a4590d637f08b776d7bcedbf36ff9bf7b3e80c6a81266039414cfac2.dll",DllRegisterServer3⤵