Analysis
-
max time kernel
63s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:09
Static task
static1
Behavioral task
behavioral1
Sample
0843fc46aa1c9f59d092519d4d66766aa5108136a1e66e4a338a0022fd7ae3ac.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
0843fc46aa1c9f59d092519d4d66766aa5108136a1e66e4a338a0022fd7ae3ac.dll
-
Size
574KB
-
MD5
416a06a72a23ec91db8dde0689e4f76b
-
SHA1
f677425a94f36d407cfc757012b215d24e75fffa
-
SHA256
0843fc46aa1c9f59d092519d4d66766aa5108136a1e66e4a338a0022fd7ae3ac
-
SHA512
c1075a784ff42075ac3c1491d9fcf4930a1eb213d6352ad508675961882963f97a1d9af271130d311e211773cb75f1ea761fda3024d3d9f9cd00218c19060895
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1028 wrote to memory of 1108 1028 regsvr32.exe regsvr32.exe PID 1028 wrote to memory of 1108 1028 regsvr32.exe regsvr32.exe PID 1028 wrote to memory of 1108 1028 regsvr32.exe regsvr32.exe PID 1108 wrote to memory of 1468 1108 regsvr32.exe rundll32.exe PID 1108 wrote to memory of 1468 1108 regsvr32.exe rundll32.exe PID 1108 wrote to memory of 1468 1108 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0843fc46aa1c9f59d092519d4d66766aa5108136a1e66e4a338a0022fd7ae3ac.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0843fc46aa1c9f59d092519d4d66766aa5108136a1e66e4a338a0022fd7ae3ac.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0843fc46aa1c9f59d092519d4d66766aa5108136a1e66e4a338a0022fd7ae3ac.dll",DllRegisterServer3⤵