Analysis
-
max time kernel
7s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
30-03-2022 00:18
Static task
static1
Behavioral task
behavioral1
Sample
d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll
-
Size
346KB
-
MD5
0195726f9576d8eddb87a16eb4f8e8db
-
SHA1
be48f8e713678473abe16b86f7f505b96461f266
-
SHA256
d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c
-
SHA512
a44eb3efbe996aca445e0b491e26585b5b9eced4227279466dd4568e60f6e35b95b718d46aac3d5d88cf9d84cfcc15b275f079192b45d33929e35813d1394064
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 284 wrote to memory of 836 284 regsvr32.exe regsvr32.exe PID 284 wrote to memory of 836 284 regsvr32.exe regsvr32.exe PID 284 wrote to memory of 836 284 regsvr32.exe regsvr32.exe PID 284 wrote to memory of 836 284 regsvr32.exe regsvr32.exe PID 284 wrote to memory of 836 284 regsvr32.exe regsvr32.exe PID 284 wrote to memory of 836 284 regsvr32.exe regsvr32.exe PID 284 wrote to memory of 836 284 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll2⤵