Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:09
Static task
static1
Behavioral task
behavioral1
Sample
25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll
-
Size
574KB
-
MD5
08cf6ea72d80dbb3f2ce9ba4a2b27aa4
-
SHA1
9ea2a40ae2814c22704945e1db6cc3c812fa11a1
-
SHA256
25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0
-
SHA512
e2e24ed1d225d5c6e5d2c17719d433e45718d068e29c8de3e8588ca4a471179d6b62def2e11f0c68b5129f96480e8e8eb4dd9b394ae6bba86aadee6e0381c9b8
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2612 wrote to memory of 2676 2612 regsvr32.exe regsvr32.exe PID 2612 wrote to memory of 2676 2612 regsvr32.exe regsvr32.exe PID 2612 wrote to memory of 2676 2612 regsvr32.exe regsvr32.exe PID 2676 wrote to memory of 2692 2676 regsvr32.exe rundll32.exe PID 2676 wrote to memory of 2692 2676 regsvr32.exe rundll32.exe PID 2676 wrote to memory of 2692 2676 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\25dfe77c0c3ea090dbb3ec6ca7387e178e4e20e65f9fbe172eb4a64fd5d0dac0.dll",DllRegisterServer3⤵