Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
63ff033366c5f712d507d7a934932443ca7ecd15728619a4aab36e4992555d5c.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
63ff033366c5f712d507d7a934932443ca7ecd15728619a4aab36e4992555d5c.dll
-
Size
574KB
-
MD5
03ddb07cee0662c292c7c573bfd91c68
-
SHA1
45d020be3875b8d9f9d791d9204c8e8c5bd03a33
-
SHA256
63ff033366c5f712d507d7a934932443ca7ecd15728619a4aab36e4992555d5c
-
SHA512
6ac99f96ff19c87c948dbe606f28c25a8d544396ca8e7e33931c2fb694eab1dbb8207a32b35db4a3fcd95da9759b4b5f774ca0238520b91a3394194f0d0d14c2
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2692 wrote to memory of 3264 2692 regsvr32.exe regsvr32.exe PID 2692 wrote to memory of 3264 2692 regsvr32.exe regsvr32.exe PID 2692 wrote to memory of 3264 2692 regsvr32.exe regsvr32.exe PID 3264 wrote to memory of 2688 3264 regsvr32.exe rundll32.exe PID 3264 wrote to memory of 2688 3264 regsvr32.exe rundll32.exe PID 3264 wrote to memory of 2688 3264 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\63ff033366c5f712d507d7a934932443ca7ecd15728619a4aab36e4992555d5c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\63ff033366c5f712d507d7a934932443ca7ecd15728619a4aab36e4992555d5c.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\63ff033366c5f712d507d7a934932443ca7ecd15728619a4aab36e4992555d5c.dll",DllRegisterServer3⤵