Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:33
Static task
static1
Behavioral task
behavioral1
Sample
3cee93dbe53ee4ab48e8514ec2803e49b7ba443efb45f38fa6df0e3a3fa4f960.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
3cee93dbe53ee4ab48e8514ec2803e49b7ba443efb45f38fa6df0e3a3fa4f960.dll
-
Size
574KB
-
MD5
af12a292a082cb71a9cb07c0db04d6ee
-
SHA1
aced408f744e15f0a546110cfeed700ef2b69f9d
-
SHA256
3cee93dbe53ee4ab48e8514ec2803e49b7ba443efb45f38fa6df0e3a3fa4f960
-
SHA512
d6de15d11930259b7a598e82dbe0330e3b2a2c826db891c92004f29d0934dd81ee452557b1037abc036d28113bd60c9481e5c9913ad05f2c0d40af1ead45cf31
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2668 wrote to memory of 3496 2668 regsvr32.exe regsvr32.exe PID 2668 wrote to memory of 3496 2668 regsvr32.exe regsvr32.exe PID 2668 wrote to memory of 3496 2668 regsvr32.exe regsvr32.exe PID 3496 wrote to memory of 3152 3496 regsvr32.exe rundll32.exe PID 3496 wrote to memory of 3152 3496 regsvr32.exe rundll32.exe PID 3496 wrote to memory of 3152 3496 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3cee93dbe53ee4ab48e8514ec2803e49b7ba443efb45f38fa6df0e3a3fa4f960.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3cee93dbe53ee4ab48e8514ec2803e49b7ba443efb45f38fa6df0e3a3fa4f960.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3cee93dbe53ee4ab48e8514ec2803e49b7ba443efb45f38fa6df0e3a3fa4f960.dll",DllRegisterServer3⤵