Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
1403f5fef20e8022fb9b6ef296b7954cf39561ed4780feb13a747f1ad5ab0afd.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
1403f5fef20e8022fb9b6ef296b7954cf39561ed4780feb13a747f1ad5ab0afd.dll
-
Size
574KB
-
MD5
9776a2bdf1173b0acf94ee57a863a8ef
-
SHA1
d4d557e3a1c4c37c51b0ddf06316f07aa48e88e8
-
SHA256
1403f5fef20e8022fb9b6ef296b7954cf39561ed4780feb13a747f1ad5ab0afd
-
SHA512
501d68a6d539d996f60dc0f0dbc02481f0c043060c7aecf3be991691e93c87e3666f62ae294693a2dc1b5619fb905afae06bf29821f1245afa08e8c19c01ab84
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2340 wrote to memory of 2444 2340 regsvr32.exe regsvr32.exe PID 2340 wrote to memory of 2444 2340 regsvr32.exe regsvr32.exe PID 2340 wrote to memory of 2444 2340 regsvr32.exe regsvr32.exe PID 2444 wrote to memory of 2756 2444 regsvr32.exe rundll32.exe PID 2444 wrote to memory of 2756 2444 regsvr32.exe rundll32.exe PID 2444 wrote to memory of 2756 2444 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1403f5fef20e8022fb9b6ef296b7954cf39561ed4780feb13a747f1ad5ab0afd.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1403f5fef20e8022fb9b6ef296b7954cf39561ed4780feb13a747f1ad5ab0afd.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1403f5fef20e8022fb9b6ef296b7954cf39561ed4780feb13a747f1ad5ab0afd.dll",DllRegisterServer3⤵