svcready | 2347501702e778fadb2ad2c7112fd6f29787f5738749ccf27bd45e15ff30a84a | Triage

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
19-07-2022 12:09

Sharing

Report Analysis Logs

General

Target

1.dll
Size

1.1MB
MD5

d2bae278b075c9f865e4677d90ab89b6
SHA1

1244f8ee92cbb46343aed523c405182f77c67e62
SHA256

2347501702e778fadb2ad2c7112fd6f29787f5738749ccf27bd45e15ff30a84a
SHA512

ac41cab614cc8287cea2ebdab2264cd0e8567ad0a31553c3d74b56b5d406b622dc79faf09cd731cb33230c8558cae479561eae1cae518b731ee913f9eab7bbb6

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/828-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	828	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 828	1364	regsvr32.exe	26
PID 1364 wrote to memory of 828	1364	regsvr32.exe	26
PID 1364 wrote to memory of 828	1364	regsvr32.exe	26
PID 1364 wrote to memory of 828	1364	regsvr32.exe	26
PID 1364 wrote to memory of 828	1364	regsvr32.exe	26
PID 1364 wrote to memory of 828	1364	regsvr32.exe	26
PID 1364 wrote to memory of 828	1364	regsvr32.exe	26
PID 828 wrote to memory of 960	828	regsvr32.exe	27
PID 828 wrote to memory of 960	828	regsvr32.exe	27
PID 828 wrote to memory of 960	828	regsvr32.exe	27
PID 828 wrote to memory of 960	828	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 300
    3⤵
    - Program crash
    PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-56-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/828-57-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1364-54-0x000007FEFB7A1000-0x000007FEFB7A3000-memory.dmp

Filesize
8KB

Download