Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:49
Static task
static1
Behavioral task
behavioral1
Sample
8270d0ce92490a0faf56621d7bbd98b1261b7cdb1b1e9eb813bfefa175873657.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
8270d0ce92490a0faf56621d7bbd98b1261b7cdb1b1e9eb813bfefa175873657.dll
-
Size
574KB
-
MD5
3224af1e204904721ab7fe6499593415
-
SHA1
716e4b287fea213c63b13123dab7d0b5d6f246e1
-
SHA256
8270d0ce92490a0faf56621d7bbd98b1261b7cdb1b1e9eb813bfefa175873657
-
SHA512
61162c4e0f64a7f943f0a4a281dc92bca0bedd1ca6cffbd74d364cea51c6fb81f485b6e10aa83ad523402ca426ca3c46ba000dbe07d82536f3f4e5e9039e8694
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3812 wrote to memory of 3420 3812 regsvr32.exe regsvr32.exe PID 3812 wrote to memory of 3420 3812 regsvr32.exe regsvr32.exe PID 3812 wrote to memory of 3420 3812 regsvr32.exe regsvr32.exe PID 3420 wrote to memory of 2596 3420 regsvr32.exe rundll32.exe PID 3420 wrote to memory of 2596 3420 regsvr32.exe rundll32.exe PID 3420 wrote to memory of 2596 3420 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8270d0ce92490a0faf56621d7bbd98b1261b7cdb1b1e9eb813bfefa175873657.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8270d0ce92490a0faf56621d7bbd98b1261b7cdb1b1e9eb813bfefa175873657.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8270d0ce92490a0faf56621d7bbd98b1261b7cdb1b1e9eb813bfefa175873657.dll",DllRegisterServer3⤵