Analysis
-
max time kernel
67s -
max time network
135s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:06
Static task
static1
General
-
Target
93249404eda253bf228b258152e391219a3c357f1a00458e017278fd4aa9034c.dll
-
Size
532KB
-
MD5
85f108c84ade393a7aae571025f040a6
-
SHA1
38b2f69cd483156d223070b05f920407cac26d14
-
SHA256
93249404eda253bf228b258152e391219a3c357f1a00458e017278fd4aa9034c
-
SHA512
68d98c4e71a9e95620f10d4b7fcb8436a43003beb20c32079c6bea661a822a8ecceba1e373156b96a99ee36dfd7ebdbdecf54df49189e32c8a3328aee5c0df7d
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2940 regsvr32.exe 2940 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3932 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3932 wrote to memory of 2940 3932 regsvr32.exe regsvr32.exe PID 3932 wrote to memory of 2940 3932 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\93249404eda253bf228b258152e391219a3c357f1a00458e017278fd4aa9034c.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\CxpcSnICN\GjPe.dll"2⤵
- Suspicious behavior: EnumeratesProcesses