Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll
-
Size
574KB
-
MD5
2c51ede92ceebd6403fbd45cc52ef403
-
SHA1
e88068e0ed4730e87533666f12bbbb13427fd182
-
SHA256
9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203
-
SHA512
1b783ec32c62d205f088e627c6d5f08c68d5ab7ac70e1e577516849ea5ffb34cd230f23efbb9571de6503f7b4a48bc321fb9e306f42527edcbd18f1975277ae9
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2632 wrote to memory of 3052 2632 regsvr32.exe regsvr32.exe PID 2632 wrote to memory of 3052 2632 regsvr32.exe regsvr32.exe PID 2632 wrote to memory of 3052 2632 regsvr32.exe regsvr32.exe PID 3052 wrote to memory of 3580 3052 regsvr32.exe rundll32.exe PID 3052 wrote to memory of 3580 3052 regsvr32.exe rundll32.exe PID 3052 wrote to memory of 3580 3052 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9c9dee48f5f838f80332f636398f84fd9a980caf2af28b5da2aa471d04b96203.dll",DllRegisterServer3⤵