svcready | 39c955c9e906075c11948edd79ffc6d6fcc5b5e3ac336231f52c3b03e718371e

Analysis

Target

y5CAB.tmp.dll
Size

559KB
MD5

6eefce6e0b2c458abf2665663cb73c2b
SHA1

563b082e19594876e8b84f22cb49b0fc4eb66a25
SHA256

39c955c9e906075c11948edd79ffc6d6fcc5b5e3ac336231f52c3b03e718371e
SHA512

44fe4de02f3b21a62e3e0f3f4b49f071028e28d9748caa137c9f9ac3fbb7f59b6daa18592a661471dedc3f78c5fc451e9f503cf1a847b578b695e106f5cb4dfe

Score

10^/10

svcready loader

Detects SVCReady loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1988-131-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready
behavioral2/memory/1988-132-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4084	1988	WerFault.exe	rundll32.exe
5072	1988	WerFault.exe	rundll32.exe
1344	1988	WerFault.exe	rundll32.exe
3032	1988	WerFault.exe	rundll32.exe
4636	1988	WerFault.exe	rundll32.exe
2564	1988	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2096 wrote to memory of 1988	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1988	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1988	2096	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y5CAB.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\y5CAB.tmp.dll,#1
  2⤵
  PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 544
    3⤵
    - Program crash
    PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 580
    3⤵
    - Program crash
    PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 684
    3⤵
    - Program crash
    PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 788
    3⤵
    - Program crash
    PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 796
    3⤵
    - Program crash
    PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 772
    3⤵
    - Program crash
    PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1988 -ip 1988
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1988 -ip 1988
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1988 -ip 1988
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1988 -ip 1988
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1988 -ip 1988
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1988 -ip 1988
1⤵
PID:3468

memory/1988-130-0x0000000000000000-mapping.dmp

Download
memory/1988-131-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1988-132-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download