Analysis
-
max time kernel
110s -
max time network
110s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
4e20ef8fd4bdb10a28feaada595d1c949023a55f073646363e48292769ab9126.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
4e20ef8fd4bdb10a28feaada595d1c949023a55f073646363e48292769ab9126.dll
-
Size
574KB
-
MD5
74466606aa543a186ab322a14258007c
-
SHA1
e2a9c8684244a9e8f8af330b9c118be94506c7e5
-
SHA256
4e20ef8fd4bdb10a28feaada595d1c949023a55f073646363e48292769ab9126
-
SHA512
f9d401f1b72196067f73833f97dc8799e1da35ecb2d647dddc0b9ecf6fa36b621f19b52225b4a297a9c51fbc89e809270891823e6d0f2ff5b45b8bb06e0e38fb
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2572 wrote to memory of 2624 2572 regsvr32.exe regsvr32.exe PID 2572 wrote to memory of 2624 2572 regsvr32.exe regsvr32.exe PID 2572 wrote to memory of 2624 2572 regsvr32.exe regsvr32.exe PID 2624 wrote to memory of 2912 2624 regsvr32.exe rundll32.exe PID 2624 wrote to memory of 2912 2624 regsvr32.exe rundll32.exe PID 2624 wrote to memory of 2912 2624 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4e20ef8fd4bdb10a28feaada595d1c949023a55f073646363e48292769ab9126.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4e20ef8fd4bdb10a28feaada595d1c949023a55f073646363e48292769ab9126.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4e20ef8fd4bdb10a28feaada595d1c949023a55f073646363e48292769ab9126.dll",DllRegisterServer3⤵