Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:09
Static task
static1
Behavioral task
behavioral1
Sample
7743d2ec991dd1e2acf220d5410293f97a7ef67f55b6363a4e20f30eb7a1a6ce.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
7743d2ec991dd1e2acf220d5410293f97a7ef67f55b6363a4e20f30eb7a1a6ce.dll
-
Size
574KB
-
MD5
9fbca0a9a6cebd0249d0642930b23be9
-
SHA1
f62258d8b90a7086fcec14272756adb8ffd5af94
-
SHA256
7743d2ec991dd1e2acf220d5410293f97a7ef67f55b6363a4e20f30eb7a1a6ce
-
SHA512
705e2b5c0bb73a1c0e63fe5ea56c7d024828c9499a23dfb8dc01e5c43fde667227733f1a80149bb034546d1a1dc8f8f6dce268704994621c6966971560ab95a1
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 400 wrote to memory of 3548 400 regsvr32.exe regsvr32.exe PID 400 wrote to memory of 3548 400 regsvr32.exe regsvr32.exe PID 400 wrote to memory of 3548 400 regsvr32.exe regsvr32.exe PID 3548 wrote to memory of 3500 3548 regsvr32.exe rundll32.exe PID 3548 wrote to memory of 3500 3548 regsvr32.exe rundll32.exe PID 3548 wrote to memory of 3500 3548 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7743d2ec991dd1e2acf220d5410293f97a7ef67f55b6363a4e20f30eb7a1a6ce.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7743d2ec991dd1e2acf220d5410293f97a7ef67f55b6363a4e20f30eb7a1a6ce.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7743d2ec991dd1e2acf220d5410293f97a7ef67f55b6363a4e20f30eb7a1a6ce.dll",DllRegisterServer3⤵