Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
4742b8c50f00ee30c45092ee14098d6e212c9cc85fe274e9d6fca5e09fca4e3f.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
4742b8c50f00ee30c45092ee14098d6e212c9cc85fe274e9d6fca5e09fca4e3f.dll
-
Size
574KB
-
MD5
e9c89b78886ed2c093642374bda3f7b4
-
SHA1
b9a00d9f6ab6af01faa2a02971279eebc1e03cfc
-
SHA256
4742b8c50f00ee30c45092ee14098d6e212c9cc85fe274e9d6fca5e09fca4e3f
-
SHA512
c4ee194dbed7f19c162d47fd898a14edd1974925174241a7dfabe50bc1192ed632141cb25117d2ba0dba7f43763e780457a6cf88bcdb098a868e8a0a0d23deae
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2484 wrote to memory of 2548 2484 regsvr32.exe regsvr32.exe PID 2484 wrote to memory of 2548 2484 regsvr32.exe regsvr32.exe PID 2484 wrote to memory of 2548 2484 regsvr32.exe regsvr32.exe PID 2548 wrote to memory of 3020 2548 regsvr32.exe rundll32.exe PID 2548 wrote to memory of 3020 2548 regsvr32.exe rundll32.exe PID 2548 wrote to memory of 3020 2548 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4742b8c50f00ee30c45092ee14098d6e212c9cc85fe274e9d6fca5e09fca4e3f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4742b8c50f00ee30c45092ee14098d6e212c9cc85fe274e9d6fca5e09fca4e3f.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4742b8c50f00ee30c45092ee14098d6e212c9cc85fe274e9d6fca5e09fca4e3f.dll",DllRegisterServer3⤵