Analysis
-
max time kernel
121s -
max time network
114s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
509a36a044485b5e9c9d973c14cddf064de4107a7bbcc2ef90ec0e0d7f247b49.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
509a36a044485b5e9c9d973c14cddf064de4107a7bbcc2ef90ec0e0d7f247b49.dll
-
Size
574KB
-
MD5
4345014edb4c2ce0f2d2ffd137e15860
-
SHA1
4d8b67bfc49b75d93ee0a556bae80635718a0317
-
SHA256
509a36a044485b5e9c9d973c14cddf064de4107a7bbcc2ef90ec0e0d7f247b49
-
SHA512
95a8d6c3ede24f2bfdebbe6ab913d448daf652435b78440ab5055f43b366d2104dc4cc777ec1944338a8f9edf18a53e773878ec9904df2fcb651c8e152d37c7f
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2152 wrote to memory of 2308 2152 regsvr32.exe regsvr32.exe PID 2152 wrote to memory of 2308 2152 regsvr32.exe regsvr32.exe PID 2152 wrote to memory of 2308 2152 regsvr32.exe regsvr32.exe PID 2308 wrote to memory of 1180 2308 regsvr32.exe rundll32.exe PID 2308 wrote to memory of 1180 2308 regsvr32.exe rundll32.exe PID 2308 wrote to memory of 1180 2308 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\509a36a044485b5e9c9d973c14cddf064de4107a7bbcc2ef90ec0e0d7f247b49.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\509a36a044485b5e9c9d973c14cddf064de4107a7bbcc2ef90ec0e0d7f247b49.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\509a36a044485b5e9c9d973c14cddf064de4107a7bbcc2ef90ec0e0d7f247b49.dll",DllRegisterServer3⤵