Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 10:56
Behavioral task
behavioral1
Sample
0da234ea41d04c041d0c331c951a31389cdb204c0291c4c9c72e9ebed66492d9.dll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0da234ea41d04c041d0c331c951a31389cdb204c0291c4c9c72e9ebed66492d9.dll
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
0da234ea41d04c041d0c331c951a31389cdb204c0291c4c9c72e9ebed66492d9.dll
-
Size
43KB
-
MD5
df451ef06bce72162579e39cf84f6b29
-
SHA1
925f6b18adc961b2a27aa35b0fc24ef565b55cd0
-
SHA256
0da234ea41d04c041d0c331c951a31389cdb204c0291c4c9c72e9ebed66492d9
-
SHA512
4f198443c82842204f21fc6646e4d0a203afbf999b24e4cb19eaee29d969b31cfd5e3af698ab4831528f4dc0865f7f028e28c3094c625056036f72a54cb9633d
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1932 wrote to memory of 1796 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1796 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1796 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1796 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1796 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1796 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1796 1932 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0da234ea41d04c041d0c331c951a31389cdb204c0291c4c9c72e9ebed66492d9.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0da234ea41d04c041d0c331c951a31389cdb204c0291c4c9c72e9ebed66492d9.dll2⤵