Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
7fd0c1bac106b1e824ea9f9e652a012036c0a767c7c1f7c6bb679a312dd2285b.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
7fd0c1bac106b1e824ea9f9e652a012036c0a767c7c1f7c6bb679a312dd2285b.dll
-
Size
574KB
-
MD5
ec6384f90fb472f4b1441d7b03dd4dc8
-
SHA1
791b42e8a75c2ba5d9c69a46683593e6fb31d0da
-
SHA256
7fd0c1bac106b1e824ea9f9e652a012036c0a767c7c1f7c6bb679a312dd2285b
-
SHA512
d7cf3764bccf66b21071980263cb8e166925ffadced3c20c99eed63440afb5e8b0173c406ac7773280536ae40f023c69253cd4211077888f84a72090509bb250
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2620 wrote to memory of 2688 2620 regsvr32.exe regsvr32.exe PID 2620 wrote to memory of 2688 2620 regsvr32.exe regsvr32.exe PID 2620 wrote to memory of 2688 2620 regsvr32.exe regsvr32.exe PID 2688 wrote to memory of 3784 2688 regsvr32.exe rundll32.exe PID 2688 wrote to memory of 3784 2688 regsvr32.exe rundll32.exe PID 2688 wrote to memory of 3784 2688 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7fd0c1bac106b1e824ea9f9e652a012036c0a767c7c1f7c6bb679a312dd2285b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7fd0c1bac106b1e824ea9f9e652a012036c0a767c7c1f7c6bb679a312dd2285b.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7fd0c1bac106b1e824ea9f9e652a012036c0a767c7c1f7c6bb679a312dd2285b.dll",DllRegisterServer3⤵