Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 09:35
Behavioral task
behavioral1
Sample
a3412d5e4378379ff6c48dc87652e2400b74e72b99bb2fad2498d21e4213010e.dll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a3412d5e4378379ff6c48dc87652e2400b74e72b99bb2fad2498d21e4213010e.dll
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
a3412d5e4378379ff6c48dc87652e2400b74e72b99bb2fad2498d21e4213010e.dll
-
Size
52KB
-
MD5
ff93684e156bb2a37e9615f9df7311d9
-
SHA1
67d862a7b7f4e3cd411dd9becb1d64190d6c5c48
-
SHA256
a3412d5e4378379ff6c48dc87652e2400b74e72b99bb2fad2498d21e4213010e
-
SHA512
92b9af32f167fd9fc214a07a7b541c405c8fb0bbe771c485ce45a87b45c6c3c24be401878fe77821ed3afca6ff10c956e9ed36f04342054cd1098aef11485569
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 308 wrote to memory of 1668 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1668 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1668 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1668 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1668 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1668 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1668 308 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a3412d5e4378379ff6c48dc87652e2400b74e72b99bb2fad2498d21e4213010e.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a3412d5e4378379ff6c48dc87652e2400b74e72b99bb2fad2498d21e4213010e.dll2⤵