Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 10:25
Behavioral task
behavioral1
Sample
4dd36263992917f2d88bc8afd9ba55fa0bd52cef38414a4071eaa713fc765061.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4dd36263992917f2d88bc8afd9ba55fa0bd52cef38414a4071eaa713fc765061.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
4dd36263992917f2d88bc8afd9ba55fa0bd52cef38414a4071eaa713fc765061.dll
-
Size
42KB
-
MD5
18e1a808cec738eefbe0c9a546be601e
-
SHA1
e2f2861833c4e8e243fb771f3c1cd2dda62e4db2
-
SHA256
4dd36263992917f2d88bc8afd9ba55fa0bd52cef38414a4071eaa713fc765061
-
SHA512
f894c92d50dc4fa61127c23409854940e5639dcaeb5bba117d724f1a1e8f441376e7bb12adc828f38db5e7acf2c13195c803b30d214e7bcc367b0f9c9ebdea7b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1628 wrote to memory of 848 1628 regsvr32.exe regsvr32.exe PID 1628 wrote to memory of 848 1628 regsvr32.exe regsvr32.exe PID 1628 wrote to memory of 848 1628 regsvr32.exe regsvr32.exe PID 1628 wrote to memory of 848 1628 regsvr32.exe regsvr32.exe PID 1628 wrote to memory of 848 1628 regsvr32.exe regsvr32.exe PID 1628 wrote to memory of 848 1628 regsvr32.exe regsvr32.exe PID 1628 wrote to memory of 848 1628 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4dd36263992917f2d88bc8afd9ba55fa0bd52cef38414a4071eaa713fc765061.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4dd36263992917f2d88bc8afd9ba55fa0bd52cef38414a4071eaa713fc765061.dll2⤵