Resubmissions

06-07-2022 08:34

220706-kgpzescfa6 10

10-02-2022 17:15

220210-vst3maaehl 10

10-02-2022 17:13

220210-vrm8paaehk 10

07-02-2022 17:48

220207-wdjh1sfbd2 4

30-01-2022 12:23

220130-pkf8xabfc3 3

Analysis

  • max time kernel
    125s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 12:23

General

  • Target

    smphost.dll

  • Size

    144KB

  • MD5

    fc484855692f2a7d1eae090086a1eb72

  • SHA1

    2e9103747750b40835f58d9e57c2ab75eeaf25f6

  • SHA256

    e58b9bbb7bcdf3e901453b7b9c9e514fed1e53565e3280353dccc77cde26a98e

  • SHA512

    2f6b6e8aa82dc4aa61a540bae1d98682ec79e73ccfeaf9c273b053c2162f35207842f7ab2f1bc06e927d706ec88ecf209d2c57e86323c38fb43e9d694e624311

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\smphost.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\smphost.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2268
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1908
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads