svcready | 015a0d0b474ac3f999517235644a38f402af28c53ae96f78e4e1ac961ebfdc91 | Triage

Analysis

max time kernel
90s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 12:20

Sharing

Report Analysis Logs

General

Target

015a0d0b474ac3f999517235644a38f402af28c53ae96f78e4e1ac961ebfdc91.dll
Size

848KB
MD5

b4e35341633082e70253b945cafb08df
SHA1

e7ec508729326c8e81f1b19d9ab4283ded21e749
SHA256

015a0d0b474ac3f999517235644a38f402af28c53ae96f78e4e1ac961ebfdc91
SHA512

ce34176e92184a5959ef75acbcfd610e0a0cc5850b573b9dba56583cc70e8db490d3ed3d83d73f4fdcb4ca1bda137a6bfcb3c9c0229abe0e4638d67ac04890fb

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2680-131-0x0000000000400000-0x00000000004D8000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4052 wrote to memory of 2680	4052	rundll32.exe	rundll32.exe
PID 4052 wrote to memory of 2680	4052	rundll32.exe	rundll32.exe
PID 4052 wrote to memory of 2680	4052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\015a0d0b474ac3f999517235644a38f402af28c53ae96f78e4e1ac961ebfdc91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\015a0d0b474ac3f999517235644a38f402af28c53ae96f78e4e1ac961ebfdc91.dll,#1
  2⤵
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-130-0x0000000000000000-mapping.dmp

Download
memory/2680-131-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2680-135-0x00000000010C0000-0x00000000010C6000-memory.dmp

Filesize
24KB

Download