Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:55
Static task
static1
Behavioral task
behavioral1
Sample
345b7794468535785b63c8bd1dfe170e90c561f64320ab0887f5c6cf792c6f7a.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
345b7794468535785b63c8bd1dfe170e90c561f64320ab0887f5c6cf792c6f7a.dll
-
Size
574KB
-
MD5
9f47f35d57e20665a60a39d9fc2c5ac0
-
SHA1
b7b220e9b5e4ac265699848eeb07145b627ccca2
-
SHA256
345b7794468535785b63c8bd1dfe170e90c561f64320ab0887f5c6cf792c6f7a
-
SHA512
7ec3d24eb7a645c416e80c1ced8a4225cd8e3dcbb8e39a9ca7afdc0c323a88b5bfb811a551e7483657ea9d70e5d695c2695f85bd250a6e6918a98a6e1c76d489
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3052 wrote to memory of 2160 3052 regsvr32.exe regsvr32.exe PID 3052 wrote to memory of 2160 3052 regsvr32.exe regsvr32.exe PID 3052 wrote to memory of 2160 3052 regsvr32.exe regsvr32.exe PID 2160 wrote to memory of 2560 2160 regsvr32.exe rundll32.exe PID 2160 wrote to memory of 2560 2160 regsvr32.exe rundll32.exe PID 2160 wrote to memory of 2560 2160 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\345b7794468535785b63c8bd1dfe170e90c561f64320ab0887f5c6cf792c6f7a.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\345b7794468535785b63c8bd1dfe170e90c561f64320ab0887f5c6cf792c6f7a.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\345b7794468535785b63c8bd1dfe170e90c561f64320ab0887f5c6cf792c6f7a.dll",DllRegisterServer3⤵