Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:34
Static task
static1
Behavioral task
behavioral1
Sample
795aea2fad5cefa7d5a01dbfa7c2f8a93dd31492807f79595cbc8ff85cfad31f.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
795aea2fad5cefa7d5a01dbfa7c2f8a93dd31492807f79595cbc8ff85cfad31f.dll
-
Size
574KB
-
MD5
00a1cadd53c56041cc6c4d93cfe0a94c
-
SHA1
34a36aea942bd0222cac32a14fa381273f42c28a
-
SHA256
795aea2fad5cefa7d5a01dbfa7c2f8a93dd31492807f79595cbc8ff85cfad31f
-
SHA512
ec17d875c38bd0ef25d26e13e16e69696f08c1b8c8b73916808b9c8065e3f03587e62d23a7a5e4b3d49a275080d3951b3afb78d92aaa76bf4c01e27c1d6e7508
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3804 wrote to memory of 3960 3804 regsvr32.exe regsvr32.exe PID 3804 wrote to memory of 3960 3804 regsvr32.exe regsvr32.exe PID 3804 wrote to memory of 3960 3804 regsvr32.exe regsvr32.exe PID 3960 wrote to memory of 4060 3960 regsvr32.exe rundll32.exe PID 3960 wrote to memory of 4060 3960 regsvr32.exe rundll32.exe PID 3960 wrote to memory of 4060 3960 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\795aea2fad5cefa7d5a01dbfa7c2f8a93dd31492807f79595cbc8ff85cfad31f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\795aea2fad5cefa7d5a01dbfa7c2f8a93dd31492807f79595cbc8ff85cfad31f.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\795aea2fad5cefa7d5a01dbfa7c2f8a93dd31492807f79595cbc8ff85cfad31f.dll",DllRegisterServer3⤵