svcready | 39c955c9e906075c11948edd79ffc6d6fcc5b5e3ac336231f52c3b03e718371e

Analysis

Target

y5CAB.tmp.dll
Size

559KB
MD5

6eefce6e0b2c458abf2665663cb73c2b
SHA1

563b082e19594876e8b84f22cb49b0fc4eb66a25
SHA256

39c955c9e906075c11948edd79ffc6d6fcc5b5e3ac336231f52c3b03e718371e
SHA512

44fe4de02f3b21a62e3e0f3f4b49f071028e28d9748caa137c9f9ac3fbb7f59b6daa18592a661471dedc3f78c5fc451e9f503cf1a847b578b695e106f5cb4dfe

Score

10^/10

svcready loader

Detects SVCReady loader 2 IoCs

resource	yara_rule
behavioral2/memory/1988-131-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready
behavioral2/memory/1988-132-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4084	1988	WerFault.exe	80
5072	1988	WerFault.exe	80
1344	1988	WerFault.exe	80
3032	1988	WerFault.exe	80
4636	1988	WerFault.exe	80
2564	1988	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1988	2096	rundll32.exe	80
PID 2096 wrote to memory of 1988	2096	rundll32.exe	80
PID 2096 wrote to memory of 1988	2096	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y5CAB.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\y5CAB.tmp.dll,#1
  2⤵
  PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 544
    3⤵
    - Program crash
    PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 580
    3⤵
    - Program crash
    PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 684
    3⤵
    - Program crash
    PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 788
    3⤵
    - Program crash
    PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 796
    3⤵
    - Program crash
    PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 772
    3⤵
    - Program crash
    PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1988 -ip 1988
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1988 -ip 1988
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1988 -ip 1988
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1988 -ip 1988
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1988 -ip 1988
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1988 -ip 1988
1⤵
PID:3468

memory/1988-131-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1988-132-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download