Analysis
-
max time kernel
42s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 07:05
Static task
static1
Behavioral task
behavioral1
Sample
530264d00763fe8b1d1d091d94819ca11101be55b1c049beedf9f8e9f544cbdd.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
530264d00763fe8b1d1d091d94819ca11101be55b1c049beedf9f8e9f544cbdd.dll
-
Size
219KB
-
MD5
d81525fba46c0b161d541281bf1f6665
-
SHA1
8e7de9b170ae08b6e9f594bfa738267cdf2640d8
-
SHA256
530264d00763fe8b1d1d091d94819ca11101be55b1c049beedf9f8e9f544cbdd
-
SHA512
023aa4a1b5005752574ec1db75d75f7be9782616cb737c752902e0f092b48b52a0d8a1c7bc7714e260c0b4eb611fe366e176683edd530d61d5ac8b09f5c56a05
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1996 wrote to memory of 1652 1996 regsvr32.exe regsvr32.exe PID 1996 wrote to memory of 1652 1996 regsvr32.exe regsvr32.exe PID 1996 wrote to memory of 1652 1996 regsvr32.exe regsvr32.exe PID 1996 wrote to memory of 1652 1996 regsvr32.exe regsvr32.exe PID 1996 wrote to memory of 1652 1996 regsvr32.exe regsvr32.exe PID 1996 wrote to memory of 1652 1996 regsvr32.exe regsvr32.exe PID 1996 wrote to memory of 1652 1996 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\530264d00763fe8b1d1d091d94819ca11101be55b1c049beedf9f8e9f544cbdd.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\530264d00763fe8b1d1d091d94819ca11101be55b1c049beedf9f8e9f544cbdd.dll2⤵