svcready | b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef | Triage™

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2022, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62f232bfd829f.dll
Size 1.2MB
Sample220809-mchqnagger
SHA256 b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef
MD5 6afec903bc7ec0aa4529eb53e0b42ca6
SHA1 dee9d64a327a559017fcc083874b3ea7851eaa86
SHA512 5eb8a109f2b1470d34c04632c50ce98e09dc14b7cd08d2f7be711f9c3f46552ea93f7301ec03e308036b303cb8f541410e5a39857ead9b908eec75866d8c0486
MD5 SHA1 SHA512

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral2/memory/4404-131-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4404	4788	regsvr32.exe	81
PID 4788 wrote to memory of 4404	4788	regsvr32.exe	81
PID 4788 wrote to memory of 4404	4788	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
  2⤵
  PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4404-131-0x0000000010000000-0x0000000010091000-memory.dmp

Download