Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
f09ca5999719a9f61f76e931c386bc2ab42e951855711a7b28a5e8f8e9ab9710.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
f09ca5999719a9f61f76e931c386bc2ab42e951855711a7b28a5e8f8e9ab9710.dll
-
Size
574KB
-
MD5
f67c7bfd9fcd267d365bdc05931fddf4
-
SHA1
16d5c8131d5b4a2b67f9ab1218242d6e2b86c3d2
-
SHA256
f09ca5999719a9f61f76e931c386bc2ab42e951855711a7b28a5e8f8e9ab9710
-
SHA512
92cd95b56c0e357dd95ef245c98bcd181d6c9885b5e5764ce9016fc76a09d6dec9becfa125ab33c12a3dcf4dfc8263973e228971af34b482f05fc7848f993222
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2180 wrote to memory of 2308 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2308 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2308 2180 regsvr32.exe regsvr32.exe PID 2308 wrote to memory of 952 2308 regsvr32.exe rundll32.exe PID 2308 wrote to memory of 952 2308 regsvr32.exe rundll32.exe PID 2308 wrote to memory of 952 2308 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f09ca5999719a9f61f76e931c386bc2ab42e951855711a7b28a5e8f8e9ab9710.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f09ca5999719a9f61f76e931c386bc2ab42e951855711a7b28a5e8f8e9ab9710.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f09ca5999719a9f61f76e931c386bc2ab42e951855711a7b28a5e8f8e9ab9710.dll",DllRegisterServer3⤵