Analysis
-
max time kernel
110s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 02:02
Static task
static1
Behavioral task
behavioral1
Sample
1a6c7fa7261f015c904a02516897fca776f9f93a2a6c6a4aaf2f1f6943b02fcc.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
1a6c7fa7261f015c904a02516897fca776f9f93a2a6c6a4aaf2f1f6943b02fcc.dll
-
Size
574KB
-
MD5
763ac2e4c8c218af9b4a8d660930ac7d
-
SHA1
6c1817a11c9c8b9dabf61ba71c75ed969531a3ed
-
SHA256
1a6c7fa7261f015c904a02516897fca776f9f93a2a6c6a4aaf2f1f6943b02fcc
-
SHA512
4fb0ce9b420d766130851a33835858f3488adbc78bb8f9d1e9eaeb54a0e11fb76315464d0ac40e696f9af3d4d8362e3c3193fb3ecf0a72353a68dc7a607d4f8c
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2464 wrote to memory of 2728 2464 regsvr32.exe regsvr32.exe PID 2464 wrote to memory of 2728 2464 regsvr32.exe regsvr32.exe PID 2464 wrote to memory of 2728 2464 regsvr32.exe regsvr32.exe PID 2728 wrote to memory of 3036 2728 regsvr32.exe rundll32.exe PID 2728 wrote to memory of 3036 2728 regsvr32.exe rundll32.exe PID 2728 wrote to memory of 3036 2728 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a6c7fa7261f015c904a02516897fca776f9f93a2a6c6a4aaf2f1f6943b02fcc.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1a6c7fa7261f015c904a02516897fca776f9f93a2a6c6a4aaf2f1f6943b02fcc.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1a6c7fa7261f015c904a02516897fca776f9f93a2a6c6a4aaf2f1f6943b02fcc.dll",DllRegisterServer3⤵