Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
914385279ac89cbe97fd93e89f9c645b2ec48fc5d6e92b954a6498f0eed315f5.dll
Resource
win10-en-20211208
General
-
Target
914385279ac89cbe97fd93e89f9c645b2ec48fc5d6e92b954a6498f0eed315f5.dll
-
Size
574KB
-
MD5
4c689d53595169c22761949614c6d0dd
-
SHA1
1cf7d094bfb879a63ca0e4c3b542ffe48ea62c1e
-
SHA256
914385279ac89cbe97fd93e89f9c645b2ec48fc5d6e92b954a6498f0eed315f5
-
SHA512
9ad21989ce7d458a1355d83f91e95f0a55548558d3ea6830fbb3ef0ff008d1b9bfd156e07a3869c957d1c66d72f8d3bf34cde424a0758c15750e8008b805142c
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2704 wrote to memory of 2752 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2752 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2752 2704 regsvr32.exe regsvr32.exe PID 2752 wrote to memory of 3452 2752 regsvr32.exe rundll32.exe PID 2752 wrote to memory of 3452 2752 regsvr32.exe rundll32.exe PID 2752 wrote to memory of 3452 2752 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\914385279ac89cbe97fd93e89f9c645b2ec48fc5d6e92b954a6498f0eed315f5.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\914385279ac89cbe97fd93e89f9c645b2ec48fc5d6e92b954a6498f0eed315f5.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\914385279ac89cbe97fd93e89f9c645b2ec48fc5d6e92b954a6498f0eed315f5.dll",DllRegisterServer3⤵