svcready | 5b8a23e134ce3e082142b3ecd36a26605776f21550e4ba03b6e15b450f59456b

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
19-07-2022 07:22

Target

f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807.dll
Size

1.1MB
MD5

7e4722c69a08c97e5f2cdd2e78c091f3
SHA1

831ae50906861832a64e61bf006d943e7fb3fac9
SHA256

f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807
SHA512

07be715ee6c245c40b618509340f90a8a6677b0525047d6808d8a4b75831e4f22f7348f31efec5deba87e7ec7042e139cefcb9fdfd7231f6518b4f14d8d7b0fc

Score

10^/10

svcready loader

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/1328-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1392	1328	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1328	272	regsvr32.exe	28
PID 272 wrote to memory of 1328	272	regsvr32.exe	28
PID 272 wrote to memory of 1328	272	regsvr32.exe	28
PID 272 wrote to memory of 1328	272	regsvr32.exe	28
PID 272 wrote to memory of 1328	272	regsvr32.exe	28
PID 272 wrote to memory of 1328	272	regsvr32.exe	28
PID 272 wrote to memory of 1328	272	regsvr32.exe	28
PID 1328 wrote to memory of 1392	1328	regsvr32.exe	29
PID 1328 wrote to memory of 1392	1328	regsvr32.exe	29
PID 1328 wrote to memory of 1392	1328	regsvr32.exe	29
PID 1328 wrote to memory of 1392	1328	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f90159634dfa11715de1d813ba5747e3e795017f75926b49d4365acc4a4ca807.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 300
    3⤵
    - Program crash
    PID:1392

memory/272-54-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download
memory/1328-56-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Filesize
8KB

Download
memory/1328-57-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download