svcready | f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
resource tags

arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system
submitted
18-07-2022 13:12

Target

831ae50906861832a64e61bf006d943e7fb3fac9.dll
Size

1.1MB
MD5

7e4722c69a08c97e5f2cdd2e78c091f3
SHA1

831ae50906861832a64e61bf006d943e7fb3fac9
SHA256

f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807
SHA512

07be715ee6c245c40b618509340f90a8a6677b0525047d6808d8a4b75831e4f22f7348f31efec5deba87e7ec7042e139cefcb9fdfd7231f6518b4f14d8d7b0fc

Score

10^/10

svcready loader

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/1292-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	1292	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1292	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1292	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1292	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1292	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1292	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1292	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1292	2036	regsvr32.exe	28
PID 1292 wrote to memory of 1508	1292	regsvr32.exe	29
PID 1292 wrote to memory of 1508	1292	regsvr32.exe	29
PID 1292 wrote to memory of 1508	1292	regsvr32.exe	29
PID 1292 wrote to memory of 1508	1292	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\831ae50906861832a64e61bf006d943e7fb3fac9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\831ae50906861832a64e61bf006d943e7fb3fac9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 300
    3⤵
    - Program crash
    PID:1508

memory/1292-56-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/1292-57-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/2036-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Filesize
8KB

Download