Analysis
-
max time kernel
111s -
max time network
114s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
27b13f798601cc034a8fa43acb36934c50a088f12d929ef242140c7c3efd4ee9.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
27b13f798601cc034a8fa43acb36934c50a088f12d929ef242140c7c3efd4ee9.dll
-
Size
574KB
-
MD5
d3ada63a742bf975c28a5ff7f045d608
-
SHA1
459771324187559446f47e0bb8ef455152d1f54f
-
SHA256
27b13f798601cc034a8fa43acb36934c50a088f12d929ef242140c7c3efd4ee9
-
SHA512
17444afeae10beda63504e46a0f35ac4e8bb1ad53a73f196e6ab157614719c0d738ef4dad20c2666d835438d46e792147f352ec9780016b72534a71d28e8c239
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2940 wrote to memory of 3532 2940 regsvr32.exe regsvr32.exe PID 2940 wrote to memory of 3532 2940 regsvr32.exe regsvr32.exe PID 2940 wrote to memory of 3532 2940 regsvr32.exe regsvr32.exe PID 3532 wrote to memory of 3880 3532 regsvr32.exe rundll32.exe PID 3532 wrote to memory of 3880 3532 regsvr32.exe rundll32.exe PID 3532 wrote to memory of 3880 3532 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\27b13f798601cc034a8fa43acb36934c50a088f12d929ef242140c7c3efd4ee9.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\27b13f798601cc034a8fa43acb36934c50a088f12d929ef242140c7c3efd4ee9.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\27b13f798601cc034a8fa43acb36934c50a088f12d929ef242140c7c3efd4ee9.dll",DllRegisterServer3⤵