Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll
-
Size
574KB
-
MD5
e1310ecd0e017d26fc29dc99a973fa07
-
SHA1
ff4c1b0eafca4e7cc8c70079d39fded035620640
-
SHA256
1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686
-
SHA512
10490a57c33370a8949abe3d88aed0035a5070797c9675a0f6aa5b337aaba1e3b400f89d38fe1cc58f0a74362cdcad60d2c6e31d189b1cd798b4e12461197290
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2588 wrote to memory of 2584 2588 regsvr32.exe regsvr32.exe PID 2588 wrote to memory of 2584 2588 regsvr32.exe regsvr32.exe PID 2588 wrote to memory of 2584 2588 regsvr32.exe regsvr32.exe PID 2584 wrote to memory of 1020 2584 regsvr32.exe rundll32.exe PID 2584 wrote to memory of 1020 2584 regsvr32.exe rundll32.exe PID 2584 wrote to memory of 1020 2584 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1a41c7db12fb2165e4235e2a756083d565d413ca8641d9786dd522eecc410686.dll",DllRegisterServer3⤵