Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 09:14
Behavioral task
behavioral1
Sample
cc35beb3f7b5fd6a38b1775f110f9ab527c90f3cf6e76b02e074dc2954955a4c.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cc35beb3f7b5fd6a38b1775f110f9ab527c90f3cf6e76b02e074dc2954955a4c.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
cc35beb3f7b5fd6a38b1775f110f9ab527c90f3cf6e76b02e074dc2954955a4c.dll
-
Size
64KB
-
MD5
6b645497a72175e510164553e888443b
-
SHA1
55c6c5b81b35713fd833cc934b9be80d378d67b7
-
SHA256
cc35beb3f7b5fd6a38b1775f110f9ab527c90f3cf6e76b02e074dc2954955a4c
-
SHA512
896b39ebfc5f21f3762292fdebd264ffad05ecad023d0b24c243d54f358be43abbf97eb2c2ceddaaa5b41a1e7da1218fdb2a4d44accd25fc66151d730c74a54d
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1268 wrote to memory of 1672 1268 regsvr32.exe regsvr32.exe PID 1268 wrote to memory of 1672 1268 regsvr32.exe regsvr32.exe PID 1268 wrote to memory of 1672 1268 regsvr32.exe regsvr32.exe PID 1268 wrote to memory of 1672 1268 regsvr32.exe regsvr32.exe PID 1268 wrote to memory of 1672 1268 regsvr32.exe regsvr32.exe PID 1268 wrote to memory of 1672 1268 regsvr32.exe regsvr32.exe PID 1268 wrote to memory of 1672 1268 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cc35beb3f7b5fd6a38b1775f110f9ab527c90f3cf6e76b02e074dc2954955a4c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cc35beb3f7b5fd6a38b1775f110f9ab527c90f3cf6e76b02e074dc2954955a4c.dll2⤵