Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
98b6a1c541f3c656066f13fdd0dc01f487cdff57f32171d421a0f75d31d56b8c.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
98b6a1c541f3c656066f13fdd0dc01f487cdff57f32171d421a0f75d31d56b8c.dll
-
Size
574KB
-
MD5
98af3ebbe84f7a7eb1cfd9c49f0ef86a
-
SHA1
dbd084442aa2ef7ba613e2f6e927d14e81becca0
-
SHA256
98b6a1c541f3c656066f13fdd0dc01f487cdff57f32171d421a0f75d31d56b8c
-
SHA512
571a9eaa6c9eb48c74ed4f27fcea0fb8599c513a3a27c22389dac900ddce97f4348313af149e1e0d46266e99094849c4c91fcfe48e73ef880daf2d9af0f62a04
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2740 wrote to memory of 3776 2740 regsvr32.exe regsvr32.exe PID 2740 wrote to memory of 3776 2740 regsvr32.exe regsvr32.exe PID 2740 wrote to memory of 3776 2740 regsvr32.exe regsvr32.exe PID 3776 wrote to memory of 3396 3776 regsvr32.exe rundll32.exe PID 3776 wrote to memory of 3396 3776 regsvr32.exe rundll32.exe PID 3776 wrote to memory of 3396 3776 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\98b6a1c541f3c656066f13fdd0dc01f487cdff57f32171d421a0f75d31d56b8c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\98b6a1c541f3c656066f13fdd0dc01f487cdff57f32171d421a0f75d31d56b8c.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\98b6a1c541f3c656066f13fdd0dc01f487cdff57f32171d421a0f75d31d56b8c.dll",DllRegisterServer3⤵