Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:09
Static task
static1
Behavioral task
behavioral1
Sample
a84f2b4e5d9ced8f19cefc1e191308e7201b8ed90ec37bae59e5172e7df11a61.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
a84f2b4e5d9ced8f19cefc1e191308e7201b8ed90ec37bae59e5172e7df11a61.dll
-
Size
574KB
-
MD5
48fdd22e03334bb5833aa9973c7ef43e
-
SHA1
e6084b172252a38f7d23e2165569adfaacb4c0c4
-
SHA256
a84f2b4e5d9ced8f19cefc1e191308e7201b8ed90ec37bae59e5172e7df11a61
-
SHA512
d82e5ded8f378992af0f3051beaa14e3fd628d6894e05bd04b4fac504ab2c23f372efad444c04b820d53566d599042b143fdb5ba3b88b1d3c89d543dbd963b2a
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3676 wrote to memory of 3648 3676 regsvr32.exe regsvr32.exe PID 3676 wrote to memory of 3648 3676 regsvr32.exe regsvr32.exe PID 3676 wrote to memory of 3648 3676 regsvr32.exe regsvr32.exe PID 3648 wrote to memory of 3484 3648 regsvr32.exe rundll32.exe PID 3648 wrote to memory of 3484 3648 regsvr32.exe rundll32.exe PID 3648 wrote to memory of 3484 3648 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a84f2b4e5d9ced8f19cefc1e191308e7201b8ed90ec37bae59e5172e7df11a61.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a84f2b4e5d9ced8f19cefc1e191308e7201b8ed90ec37bae59e5172e7df11a61.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a84f2b4e5d9ced8f19cefc1e191308e7201b8ed90ec37bae59e5172e7df11a61.dll",DllRegisterServer3⤵