Analysis
-
max time kernel
1s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
30-03-2022 08:56
Static task
static1
Behavioral task
behavioral1
Sample
7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll
-
Size
346KB
-
MD5
8ac9bfffecc62e98377b6377f15270af
-
SHA1
59e22784f4404bfdb505fbd3e8f52ed67d57f5f6
-
SHA256
7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f
-
SHA512
5b7126afcb85d2b32e2ed374ec2ac4e450b98e487ee7a78dbfefc56d5a0db691510673528d00cfb8d8ff46f4dbd1f6e494db837c40c39ec7993a9fa26048210b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 892 wrote to memory of 936 892 regsvr32.exe regsvr32.exe PID 892 wrote to memory of 936 892 regsvr32.exe regsvr32.exe PID 892 wrote to memory of 936 892 regsvr32.exe regsvr32.exe PID 892 wrote to memory of 936 892 regsvr32.exe regsvr32.exe PID 892 wrote to memory of 936 892 regsvr32.exe regsvr32.exe PID 892 wrote to memory of 936 892 regsvr32.exe regsvr32.exe PID 892 wrote to memory of 936 892 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll2⤵