Resubmissions
27-01-2022 11:13
220127-nbxzmabhc4 1018-01-2022 01:25
220118-bsxzqsfad5 1015-01-2022 16:15
220115-tp8wyafbej 1Analysis
-
max time kernel
17s -
max time network
17s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-01-2022 16:15
Static task
static1
Behavioral task
behavioral1
Sample
test.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
test.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
test.dll
-
Size
574KB
-
MD5
653d1f7df97c7be3a887b4d860a0a5b9
-
SHA1
6acbcb4c9c9d574454ae971c49b1d09257df43d9
-
SHA256
b6736050938db1c2cd9ed705c9233d90e9876cea67b0d7cc4644d92ac7cb6e20
-
SHA512
3f769448831ea107b02ce9f9fb189605ad2acf804a649e7e565dae3335a505683a7d756d89bd92ecc1dc720f708b989fa87598a17dc071621a87346e4b8f6125
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 944 wrote to memory of 836 944 regsvr32.exe regsvr32.exe PID 944 wrote to memory of 836 944 regsvr32.exe regsvr32.exe PID 944 wrote to memory of 836 944 regsvr32.exe regsvr32.exe PID 944 wrote to memory of 836 944 regsvr32.exe regsvr32.exe PID 944 wrote to memory of 836 944 regsvr32.exe regsvr32.exe PID 944 wrote to memory of 836 944 regsvr32.exe regsvr32.exe PID 944 wrote to memory of 836 944 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 1832 836 regsvr32.exe rundll32.exe PID 836 wrote to memory of 1832 836 regsvr32.exe rundll32.exe PID 836 wrote to memory of 1832 836 regsvr32.exe rundll32.exe PID 836 wrote to memory of 1832 836 regsvr32.exe rundll32.exe PID 836 wrote to memory of 1832 836 regsvr32.exe rundll32.exe PID 836 wrote to memory of 1832 836 regsvr32.exe rundll32.exe PID 836 wrote to memory of 1832 836 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\test.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\test.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\test.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-56-0x0000000000000000-mapping.dmp
-
memory/836-57-0x0000000075F91000-0x0000000075F93000-memory.dmpFilesize
8KB
-
memory/836-59-0x0000000000165000-0x0000000000166000-memory.dmpFilesize
4KB
-
memory/836-58-0x0000000000141000-0x0000000000165000-memory.dmpFilesize
144KB
-
memory/944-55-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmpFilesize
8KB
-
memory/1832-60-0x0000000000000000-mapping.dmp