Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll
-
Size
574KB
-
MD5
d315c4fac3a11e1fafe902d8944e9070
-
SHA1
a788cf7069901d31921b6bf501fa97dd580427e1
-
SHA256
2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4
-
SHA512
1a3943a4f02c35f990d524028f2ee254de71ee2393b54f149122efd37f040b6ff356b5eda5bcab2934776879349a52b66a2bc4638efac8c697f57b39d035a91b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1672 wrote to memory of 3400 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 3400 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 3400 1672 regsvr32.exe regsvr32.exe PID 3400 wrote to memory of 3816 3400 regsvr32.exe rundll32.exe PID 3400 wrote to memory of 3816 3400 regsvr32.exe rundll32.exe PID 3400 wrote to memory of 3816 3400 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2cb6858356a71b0f86fb186a55b7bd1bf9cf11157834cd36e6c4baa1dd324da4.dll",DllRegisterServer3⤵