Analysis
-
max time kernel
39s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-04-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll
-
Size
160KB
-
MD5
df8a2b2a908ec9c91873791d342d5f61
-
SHA1
87d4d15f6cd4311a5bd9bb3d3ed36fbdebe37410
-
SHA256
ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81
-
SHA512
9b6e3787f4f22422b7fe912d1060c401c57133086a8249c8d1e2a7a01dae410be72837a31a70b32bc8dcd296e44493b2421aa455ca47380c4da55cd65990254b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2016 wrote to memory of 112 2016 regsvr32.exe regsvr32.exe PID 2016 wrote to memory of 112 2016 regsvr32.exe regsvr32.exe PID 2016 wrote to memory of 112 2016 regsvr32.exe regsvr32.exe PID 2016 wrote to memory of 112 2016 regsvr32.exe regsvr32.exe PID 2016 wrote to memory of 112 2016 regsvr32.exe regsvr32.exe PID 2016 wrote to memory of 112 2016 regsvr32.exe regsvr32.exe PID 2016 wrote to memory of 112 2016 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll2⤵