Analysis
-
max time kernel
87s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
669fc7e499c81601e8ad499adc2691b59a4a3e065861f6f9343e738881e3b2a4.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
669fc7e499c81601e8ad499adc2691b59a4a3e065861f6f9343e738881e3b2a4.dll
-
Size
574KB
-
MD5
b4d0188338c16bb2dd7c98a295da5e23
-
SHA1
5a79d7953ddcf76c6287bdc43649b445285a1710
-
SHA256
669fc7e499c81601e8ad499adc2691b59a4a3e065861f6f9343e738881e3b2a4
-
SHA512
a890deace814e7e64b4c186c3c1f56b537a6656d0b2f1d0dcf225792b8183b31c4b0a0cdec470c69feffd12f467404efb34ea23aef7ddab3249490978d690fd7
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 668 wrote to memory of 2536 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 2536 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 2536 668 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 3464 2536 regsvr32.exe rundll32.exe PID 2536 wrote to memory of 3464 2536 regsvr32.exe rundll32.exe PID 2536 wrote to memory of 3464 2536 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\669fc7e499c81601e8ad499adc2691b59a4a3e065861f6f9343e738881e3b2a4.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\669fc7e499c81601e8ad499adc2691b59a4a3e065861f6f9343e738881e3b2a4.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\669fc7e499c81601e8ad499adc2691b59a4a3e065861f6f9343e738881e3b2a4.dll",DllRegisterServer3⤵