Analysis
-
max time kernel
121s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:49
Static task
static1
Behavioral task
behavioral1
Sample
e4874629969c46209f2c2a27041b2dc32d8d55c0664042745a8686a17234c465.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
e4874629969c46209f2c2a27041b2dc32d8d55c0664042745a8686a17234c465.dll
-
Size
574KB
-
MD5
0449ef16213eb4d0d8a4b4648c3fec15
-
SHA1
a6e9978ae963a7819717b5904087b173ec68733b
-
SHA256
e4874629969c46209f2c2a27041b2dc32d8d55c0664042745a8686a17234c465
-
SHA512
d1dc2911f89ece457f03bfcecbc84a5b343b5a78feef6f1bd0aa89aad7cd76c2af82006988a56254b942d8ca22d0a7bf268368a277a926b6dcb9c8d7e1c6c940
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3732 wrote to memory of 3424 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 3424 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 3424 3732 regsvr32.exe regsvr32.exe PID 3424 wrote to memory of 3524 3424 regsvr32.exe rundll32.exe PID 3424 wrote to memory of 3524 3424 regsvr32.exe rundll32.exe PID 3424 wrote to memory of 3524 3424 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4874629969c46209f2c2a27041b2dc32d8d55c0664042745a8686a17234c465.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e4874629969c46209f2c2a27041b2dc32d8d55c0664042745a8686a17234c465.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e4874629969c46209f2c2a27041b2dc32d8d55c0664042745a8686a17234c465.dll",DllRegisterServer3⤵