Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:09
Static task
static1
Behavioral task
behavioral1
Sample
bc1dd7b02c3e7b41ca2b288db3aa0bf6190dcb53a390b5d256fce744a1e177bf.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
bc1dd7b02c3e7b41ca2b288db3aa0bf6190dcb53a390b5d256fce744a1e177bf.dll
-
Size
574KB
-
MD5
5bd9167b6989e12370b6b2732871c27e
-
SHA1
6a714277368797717ed8335f8402b0d4a7e14878
-
SHA256
bc1dd7b02c3e7b41ca2b288db3aa0bf6190dcb53a390b5d256fce744a1e177bf
-
SHA512
d20db5b6f9a257f5cb1f40d408bfc4177fb8d8112d1d6f9bb9e2e5ca63c4b6d942b0da0b465ea53f5816972946e17ee7200ecb2f958bacd628ca38436912b9c3
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2340 wrote to memory of 2444 2340 regsvr32.exe regsvr32.exe PID 2340 wrote to memory of 2444 2340 regsvr32.exe regsvr32.exe PID 2340 wrote to memory of 2444 2340 regsvr32.exe regsvr32.exe PID 2444 wrote to memory of 2548 2444 regsvr32.exe rundll32.exe PID 2444 wrote to memory of 2548 2444 regsvr32.exe rundll32.exe PID 2444 wrote to memory of 2548 2444 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bc1dd7b02c3e7b41ca2b288db3aa0bf6190dcb53a390b5d256fce744a1e177bf.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\bc1dd7b02c3e7b41ca2b288db3aa0bf6190dcb53a390b5d256fce744a1e177bf.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bc1dd7b02c3e7b41ca2b288db3aa0bf6190dcb53a390b5d256fce744a1e177bf.dll",DllRegisterServer3⤵