Analysis
-
max time kernel
110s -
max time network
115s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
ee2443264691abaf2a9d36c48fd138043586a657aa9b53f48a27e355acea69a1.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
ee2443264691abaf2a9d36c48fd138043586a657aa9b53f48a27e355acea69a1.dll
-
Size
574KB
-
MD5
1c4be76b3767ed009c31653ac1ac1719
-
SHA1
5d0e82a3e67e77b4f536e36e7fd21c6e0482370c
-
SHA256
ee2443264691abaf2a9d36c48fd138043586a657aa9b53f48a27e355acea69a1
-
SHA512
f24aedd1ccfc3570090413a41b8cda17592d2ec46c03811b7dcd92d0e7001788f7412bffe6653178464265050b75c2af46a3ab38a72f6d94bd8982c97217d9fe
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2600 wrote to memory of 2776 2600 regsvr32.exe regsvr32.exe PID 2600 wrote to memory of 2776 2600 regsvr32.exe regsvr32.exe PID 2600 wrote to memory of 2776 2600 regsvr32.exe regsvr32.exe PID 2776 wrote to memory of 2900 2776 regsvr32.exe rundll32.exe PID 2776 wrote to memory of 2900 2776 regsvr32.exe rundll32.exe PID 2776 wrote to memory of 2900 2776 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ee2443264691abaf2a9d36c48fd138043586a657aa9b53f48a27e355acea69a1.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ee2443264691abaf2a9d36c48fd138043586a657aa9b53f48a27e355acea69a1.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ee2443264691abaf2a9d36c48fd138043586a657aa9b53f48a27e355acea69a1.dll",DllRegisterServer3⤵