Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 02:02
Static task
static1
Behavioral task
behavioral1
Sample
81c531864191ada9bd5eebe648e98e8f022ff9ba8fe8f3c250b685db0eeea23f.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
81c531864191ada9bd5eebe648e98e8f022ff9ba8fe8f3c250b685db0eeea23f.dll
-
Size
574KB
-
MD5
a9c590405af291ea2b6c9c84ee21bcb8
-
SHA1
0468e6c09bd5f13f4b17e8ae39cdc8334ecfbc59
-
SHA256
81c531864191ada9bd5eebe648e98e8f022ff9ba8fe8f3c250b685db0eeea23f
-
SHA512
808dc6c9e1e41f242229e6327733317f86b5eaf7624312ccb0351f80e0fce42e90a0e7b167bd236c045ddd45818fa6cc9db96866f64a445de5fa94de8f9d5d5b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2336 wrote to memory of 2540 2336 regsvr32.exe regsvr32.exe PID 2336 wrote to memory of 2540 2336 regsvr32.exe regsvr32.exe PID 2336 wrote to memory of 2540 2336 regsvr32.exe regsvr32.exe PID 2540 wrote to memory of 2776 2540 regsvr32.exe rundll32.exe PID 2540 wrote to memory of 2776 2540 regsvr32.exe rundll32.exe PID 2540 wrote to memory of 2776 2540 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\81c531864191ada9bd5eebe648e98e8f022ff9ba8fe8f3c250b685db0eeea23f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\81c531864191ada9bd5eebe648e98e8f022ff9ba8fe8f3c250b685db0eeea23f.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\81c531864191ada9bd5eebe648e98e8f022ff9ba8fe8f3c250b685db0eeea23f.dll",DllRegisterServer3⤵