Analysis
-
max time kernel
121s -
max time network
113s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:34
Static task
static1
Behavioral task
behavioral1
Sample
7b95aa94b87466a86dd0b4bba7cf7b5d7fcdc230e4c504c4c46220516c566d3c.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
7b95aa94b87466a86dd0b4bba7cf7b5d7fcdc230e4c504c4c46220516c566d3c.dll
-
Size
574KB
-
MD5
94c9cc9360895c0019ef597e2a39248b
-
SHA1
6c8dd12fabfd5bd31c1cacb3aeb4e3955c03c901
-
SHA256
7b95aa94b87466a86dd0b4bba7cf7b5d7fcdc230e4c504c4c46220516c566d3c
-
SHA512
d9e3e34a1776323228b615de76971682aa7371da95e0ae45c813d44603fb7b03683c704b97f1153b43516d985590b83036727e634d5285201cfabf83f0746cac
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3896 wrote to memory of 1992 3896 regsvr32.exe regsvr32.exe PID 3896 wrote to memory of 1992 3896 regsvr32.exe regsvr32.exe PID 3896 wrote to memory of 1992 3896 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 3156 1992 regsvr32.exe rundll32.exe PID 1992 wrote to memory of 3156 1992 regsvr32.exe rundll32.exe PID 1992 wrote to memory of 3156 1992 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7b95aa94b87466a86dd0b4bba7cf7b5d7fcdc230e4c504c4c46220516c566d3c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7b95aa94b87466a86dd0b4bba7cf7b5d7fcdc230e4c504c4c46220516c566d3c.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7b95aa94b87466a86dd0b4bba7cf7b5d7fcdc230e4c504c4c46220516c566d3c.dll",DllRegisterServer3⤵