Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:49
Static task
static1
Behavioral task
behavioral1
Sample
74e296f7a78409b36b7014d2b7ba2b60b273bd65532e902d41324bd5eefa701a.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
74e296f7a78409b36b7014d2b7ba2b60b273bd65532e902d41324bd5eefa701a.dll
-
Size
574KB
-
MD5
3c58b73d57fef051d729747a9222a841
-
SHA1
ada54dd6633a5fade76c78a5336cf721cd9d8dc4
-
SHA256
74e296f7a78409b36b7014d2b7ba2b60b273bd65532e902d41324bd5eefa701a
-
SHA512
64e8033ca63db47429eddd97c385bc514aa3cab4fc5d975d4a047129315923280ba93932d4040b365b77715cee9597bbc6f39ea44351b444941e03e3172a7d4c
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3708 wrote to memory of 3716 3708 regsvr32.exe regsvr32.exe PID 3708 wrote to memory of 3716 3708 regsvr32.exe regsvr32.exe PID 3708 wrote to memory of 3716 3708 regsvr32.exe regsvr32.exe PID 3716 wrote to memory of 3844 3716 regsvr32.exe rundll32.exe PID 3716 wrote to memory of 3844 3716 regsvr32.exe rundll32.exe PID 3716 wrote to memory of 3844 3716 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\74e296f7a78409b36b7014d2b7ba2b60b273bd65532e902d41324bd5eefa701a.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\74e296f7a78409b36b7014d2b7ba2b60b273bd65532e902d41324bd5eefa701a.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\74e296f7a78409b36b7014d2b7ba2b60b273bd65532e902d41324bd5eefa701a.dll",DllRegisterServer3⤵