Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:09
Static task
static1
Behavioral task
behavioral1
Sample
d6ef8af00c88ad84f0eac708d3d7e3d31f76fcd20793c7345ed0b30cd0d572a0.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
d6ef8af00c88ad84f0eac708d3d7e3d31f76fcd20793c7345ed0b30cd0d572a0.dll
-
Size
574KB
-
MD5
147f8635d187ae9bf5a363be04477aad
-
SHA1
e0419facc968f58e53290f44b9e2a137122ea0e3
-
SHA256
d6ef8af00c88ad84f0eac708d3d7e3d31f76fcd20793c7345ed0b30cd0d572a0
-
SHA512
5c5a19325055f8a1536cd488c2fa8e35ec8b0fa4e71757098cde6f781804fc2e4a74219cc110619a10f6d722119eb6c5bf52960f2b8c9dfc5887f7e520479ee0
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3736 wrote to memory of 3320 3736 regsvr32.exe regsvr32.exe PID 3736 wrote to memory of 3320 3736 regsvr32.exe regsvr32.exe PID 3736 wrote to memory of 3320 3736 regsvr32.exe regsvr32.exe PID 3320 wrote to memory of 3940 3320 regsvr32.exe rundll32.exe PID 3320 wrote to memory of 3940 3320 regsvr32.exe rundll32.exe PID 3320 wrote to memory of 3940 3320 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d6ef8af00c88ad84f0eac708d3d7e3d31f76fcd20793c7345ed0b30cd0d572a0.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d6ef8af00c88ad84f0eac708d3d7e3d31f76fcd20793c7345ed0b30cd0d572a0.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d6ef8af00c88ad84f0eac708d3d7e3d31f76fcd20793c7345ed0b30cd0d572a0.dll",DllRegisterServer3⤵