svcready | b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
09/08/2022, 10:19

Target
62f232bfd829f.dll
Size 1.2MB
Sample220809-mchqnagger
SHA256 b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef
MD5 6afec903bc7ec0aa4529eb53e0b42ca6
SHA1 dee9d64a327a559017fcc083874b3ea7851eaa86
SHA512 5eb8a109f2b1470d34c04632c50ce98e09dc14b7cd08d2f7be711f9c3f46552ea93f7301ec03e308036b303cb8f541410e5a39857ead9b908eec75866d8c0486
MD5 SHA1 SHA512

Score

10^/10

svcready loader

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/1964-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1964	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 296
    3⤵
    - Program crash
    PID:1648

memory/308-54-0x000007FEFBEC1000-0x000007FEFBEC3000-memory.dmp

Download

memory/1964-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Download

memory/1964-57-0x0000000010000000-0x0000000010091000-memory.dmp

Download