svcready | b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
09-08-2022 10:19

Sharing

Report Analysis Logs

General

Target

62f232bfd829f.dll
Size

1.2MB
MD5

6afec903bc7ec0aa4529eb53e0b42ca6
SHA1

dee9d64a327a559017fcc083874b3ea7851eaa86
SHA256

b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef
SHA512

5eb8a109f2b1470d34c04632c50ce98e09dc14b7cd08d2f7be711f9c3f46552ea93f7301ec03e308036b303cb8f541410e5a39857ead9b908eec75866d8c0486

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/1964-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1964	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 308 wrote to memory of 1964	308	regsvr32.exe	28
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29
PID 1964 wrote to memory of 1648	1964	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 296
    3⤵
    - Program crash
    PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-54-0x000007FEFBEC1000-0x000007FEFBEC3000-memory.dmp

Filesize
8KB

Download
memory/1964-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1964-57-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download