Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
07-04-2022 16:19
Static task
static1
Behavioral task
behavioral1
Sample
0fa38d62e10a8aae27e6624c29e94dc0.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0fa38d62e10a8aae27e6624c29e94dc0.dll
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
0fa38d62e10a8aae27e6624c29e94dc0.dll
-
Size
1.2MB
-
MD5
0fa38d62e10a8aae27e6624c29e94dc0
-
SHA1
38eacb884c084f9e455e6e32002661a95bb7e4f5
-
SHA256
1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f
-
SHA512
bb283a71face353a3cec670442ddef2b8eab5fcfe1d0893c7ed195880356f4181f1b56854a54e95174b518db7c72fa9e094954e81fa10149c6cfb3424b650419
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1060 regsvr32.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1060 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fa38d62e10a8aae27e6624c29e94dc0.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0fa38d62e10a8aae27e6624c29e94dc0.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:616
-
-