Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:55
Static task
static1
Behavioral task
behavioral1
Sample
2c96b1733861ec9ee91e7e9d7ec29bf286621b73c6adeb5b8a66f66d4b5ec414.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
2c96b1733861ec9ee91e7e9d7ec29bf286621b73c6adeb5b8a66f66d4b5ec414.dll
-
Size
574KB
-
MD5
a890b8b7e85e40aab182464e0ee992bc
-
SHA1
2b1f39014b210455a203196677fb7e4e7903b559
-
SHA256
2c96b1733861ec9ee91e7e9d7ec29bf286621b73c6adeb5b8a66f66d4b5ec414
-
SHA512
5609ad85697ed1f5ea4c63f650176dad1608b11491cf1c6af796b951477047569e70df90181237b1ae513e1cc8f58b84192b27969cf47b51c0ede495ca289211
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2144 wrote to memory of 3564 2144 regsvr32.exe regsvr32.exe PID 2144 wrote to memory of 3564 2144 regsvr32.exe regsvr32.exe PID 2144 wrote to memory of 3564 2144 regsvr32.exe regsvr32.exe PID 3564 wrote to memory of 3976 3564 regsvr32.exe rundll32.exe PID 3564 wrote to memory of 3976 3564 regsvr32.exe rundll32.exe PID 3564 wrote to memory of 3976 3564 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2c96b1733861ec9ee91e7e9d7ec29bf286621b73c6adeb5b8a66f66d4b5ec414.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2c96b1733861ec9ee91e7e9d7ec29bf286621b73c6adeb5b8a66f66d4b5ec414.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2c96b1733861ec9ee91e7e9d7ec29bf286621b73c6adeb5b8a66f66d4b5ec414.dll",DllRegisterServer3⤵