Analysis
-
max time kernel
111s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
0ada389ec989f3123315285264fc9426d0f97c1b7bef45d93619ac4fc0e05e68.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
0ada389ec989f3123315285264fc9426d0f97c1b7bef45d93619ac4fc0e05e68.dll
-
Size
574KB
-
MD5
46941f874fef1cdf30f56256f37c2450
-
SHA1
3fb79d64483927aa493ed90dde55820bc2e0dbbc
-
SHA256
0ada389ec989f3123315285264fc9426d0f97c1b7bef45d93619ac4fc0e05e68
-
SHA512
37e4e2c7771576d26ff97b790e017bb3373fa07914e48b1a8106cbf881bd5612b31fe046f9ff222166e7607f64e69972e1ec495e7cd4b62a4b4174a98732395c
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1480 wrote to memory of 3412 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 3412 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 3412 1480 regsvr32.exe regsvr32.exe PID 3412 wrote to memory of 3816 3412 regsvr32.exe rundll32.exe PID 3412 wrote to memory of 3816 3412 regsvr32.exe rundll32.exe PID 3412 wrote to memory of 3816 3412 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ada389ec989f3123315285264fc9426d0f97c1b7bef45d93619ac4fc0e05e68.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0ada389ec989f3123315285264fc9426d0f97c1b7bef45d93619ac4fc0e05e68.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0ada389ec989f3123315285264fc9426d0f97c1b7bef45d93619ac4fc0e05e68.dll",DllRegisterServer3⤵