Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
e04d4c9874bdaccc55cb8a43e93e35b14613ea76a87e535b6a3d5c33efbd5b83.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
e04d4c9874bdaccc55cb8a43e93e35b14613ea76a87e535b6a3d5c33efbd5b83.dll
-
Size
574KB
-
MD5
34851b7bb1d60b509d9678ee5cea3169
-
SHA1
cc6f13be11d4bc51d09d79d30d9586ebe21d59b3
-
SHA256
e04d4c9874bdaccc55cb8a43e93e35b14613ea76a87e535b6a3d5c33efbd5b83
-
SHA512
b22641ef2cbe95250a9d0d16ec03e43469fab5bf11cdf1dd4a83f4851252c6407b6b68b9a818ce3b6d414ec6f73bb64778c42fa4d97a0c2e951429a2e64e0fd4
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 456 wrote to memory of 3972 456 regsvr32.exe regsvr32.exe PID 456 wrote to memory of 3972 456 regsvr32.exe regsvr32.exe PID 456 wrote to memory of 3972 456 regsvr32.exe regsvr32.exe PID 3972 wrote to memory of 1136 3972 regsvr32.exe rundll32.exe PID 3972 wrote to memory of 1136 3972 regsvr32.exe rundll32.exe PID 3972 wrote to memory of 1136 3972 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e04d4c9874bdaccc55cb8a43e93e35b14613ea76a87e535b6a3d5c33efbd5b83.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e04d4c9874bdaccc55cb8a43e93e35b14613ea76a87e535b6a3d5c33efbd5b83.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e04d4c9874bdaccc55cb8a43e93e35b14613ea76a87e535b6a3d5c33efbd5b83.dll",DllRegisterServer3⤵