Analysis
-
max time kernel
121s -
max time network
111s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
4955c17a8827be9d3a1ba463a376fc6ef73b8be2d46e5719cef2d3cc6503c45b.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
4955c17a8827be9d3a1ba463a376fc6ef73b8be2d46e5719cef2d3cc6503c45b.dll
-
Size
574KB
-
MD5
5ca85d23543e7ed34c01e599c97137b1
-
SHA1
6bf107df5274ab8b680f3bc176c37deb5ffc0180
-
SHA256
4955c17a8827be9d3a1ba463a376fc6ef73b8be2d46e5719cef2d3cc6503c45b
-
SHA512
3799b2f5e5fcbde22376d6d494deef44aa7bbbfc3388d14c7439fcd70fd148d478d202123deaadda53aeb5a7e1b62ebda4ddf9c8f1a6ea7b680eff1644388385
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 616 wrote to memory of 2720 616 regsvr32.exe regsvr32.exe PID 616 wrote to memory of 2720 616 regsvr32.exe regsvr32.exe PID 616 wrote to memory of 2720 616 regsvr32.exe regsvr32.exe PID 2720 wrote to memory of 1924 2720 regsvr32.exe rundll32.exe PID 2720 wrote to memory of 1924 2720 regsvr32.exe rundll32.exe PID 2720 wrote to memory of 1924 2720 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4955c17a8827be9d3a1ba463a376fc6ef73b8be2d46e5719cef2d3cc6503c45b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4955c17a8827be9d3a1ba463a376fc6ef73b8be2d46e5719cef2d3cc6503c45b.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4955c17a8827be9d3a1ba463a376fc6ef73b8be2d46e5719cef2d3cc6503c45b.dll",DllRegisterServer3⤵