Analysis
-
max time kernel
30s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
14-04-2022 06:55
Static task
static1
Behavioral task
behavioral1
Sample
aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll
-
Size
195KB
-
MD5
37f179fb4e176d979ebd8f9bc549fe2f
-
SHA1
4f8868091097895d059db293905925d8fcc199ea
-
SHA256
aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849
-
SHA512
100ff183acf53d34bd00a6469a8d4248d7f692fd05fe4724169b395903e85da5fe9fa43ed07c2612156b0ef6ad28249d321cdfccf57dff85872caa3e7284edef
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1840 wrote to memory of 1736 1840 regsvr32.exe regsvr32.exe PID 1840 wrote to memory of 1736 1840 regsvr32.exe regsvr32.exe PID 1840 wrote to memory of 1736 1840 regsvr32.exe regsvr32.exe PID 1840 wrote to memory of 1736 1840 regsvr32.exe regsvr32.exe PID 1840 wrote to memory of 1736 1840 regsvr32.exe regsvr32.exe PID 1840 wrote to memory of 1736 1840 regsvr32.exe regsvr32.exe PID 1840 wrote to memory of 1736 1840 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll2⤵