Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:17
Static task
static1
Behavioral task
behavioral1
Sample
8b3ee84f2e4ba04a5109045ac4ace527242a83d3f4bef85b183820aa77cfc6ba.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
8b3ee84f2e4ba04a5109045ac4ace527242a83d3f4bef85b183820aa77cfc6ba.dll
-
Size
574KB
-
MD5
df74b4aab7b90abd891c0c569021d417
-
SHA1
6f485b9b79af1a17e109d26f75833fc1b0569a25
-
SHA256
8b3ee84f2e4ba04a5109045ac4ace527242a83d3f4bef85b183820aa77cfc6ba
-
SHA512
0dcd7adefc59062a71da488900f1034f8a7ddacce5f413aa9f9ee857f5d0ab6343340b4322accde3b3eb4911d283ea70550d5f2831f279c7cafb256538fe5e38
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3060 wrote to memory of 2352 3060 regsvr32.exe regsvr32.exe PID 3060 wrote to memory of 2352 3060 regsvr32.exe regsvr32.exe PID 3060 wrote to memory of 2352 3060 regsvr32.exe regsvr32.exe PID 2352 wrote to memory of 4076 2352 regsvr32.exe rundll32.exe PID 2352 wrote to memory of 4076 2352 regsvr32.exe rundll32.exe PID 2352 wrote to memory of 4076 2352 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b3ee84f2e4ba04a5109045ac4ace527242a83d3f4bef85b183820aa77cfc6ba.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8b3ee84f2e4ba04a5109045ac4ace527242a83d3f4bef85b183820aa77cfc6ba.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8b3ee84f2e4ba04a5109045ac4ace527242a83d3f4bef85b183820aa77cfc6ba.dll",DllRegisterServer3⤵