Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 13:32
Static task
static1
Behavioral task
behavioral1
Sample
e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll
-
Size
242KB
-
MD5
7b07db7c5b61c1a6195d1797d9d6a495
-
SHA1
796131744a7eef358f836a17cf668ea984480433
-
SHA256
e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55
-
SHA512
c9fb00512df6913f45a291d73e7885c7aea19431dadc9d87f42e6c6a98f3ae9a0b0abcbd5b66ddbe5e3fa810f9351bc167cfb28ad2bd950d8f77b6f25e6b4953
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1592 wrote to memory of 1912 1592 regsvr32.exe regsvr32.exe PID 1592 wrote to memory of 1912 1592 regsvr32.exe regsvr32.exe PID 1592 wrote to memory of 1912 1592 regsvr32.exe regsvr32.exe PID 1592 wrote to memory of 1912 1592 regsvr32.exe regsvr32.exe PID 1592 wrote to memory of 1912 1592 regsvr32.exe regsvr32.exe PID 1592 wrote to memory of 1912 1592 regsvr32.exe regsvr32.exe PID 1592 wrote to memory of 1912 1592 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll2⤵