svcready | b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
09/08/2022, 10:19

Target
62f232bfd829f.dll
Size 1.2MB
Sample220809-mcmdvaaee4
SHA256 b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef
MD5 6afec903bc7ec0aa4529eb53e0b42ca6
SHA1 dee9d64a327a559017fcc083874b3ea7851eaa86
SHA512 5eb8a109f2b1470d34c04632c50ce98e09dc14b7cd08d2f7be711f9c3f46552ea93f7301ec03e308036b303cb8f541410e5a39857ead9b908eec75866d8c0486
MD5 SHA1 SHA512

Score

10^/10

svcready loader

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/1008-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	1008	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1008	752	regsvr32.exe	28
PID 752 wrote to memory of 1008	752	regsvr32.exe	28
PID 752 wrote to memory of 1008	752	regsvr32.exe	28
PID 752 wrote to memory of 1008	752	regsvr32.exe	28
PID 752 wrote to memory of 1008	752	regsvr32.exe	28
PID 752 wrote to memory of 1008	752	regsvr32.exe	28
PID 752 wrote to memory of 1008	752	regsvr32.exe	28
PID 1008 wrote to memory of 1212	1008	regsvr32.exe	29
PID 1008 wrote to memory of 1212	1008	regsvr32.exe	29
PID 1008 wrote to memory of 1212	1008	regsvr32.exe	29
PID 1008 wrote to memory of 1212	1008	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 296
    3⤵
    - Program crash
    PID:1212

memory/752-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Download

memory/1008-56-0x0000000074D61000-0x0000000074D63000-memory.dmp

Download

memory/1008-57-0x0000000010000000-0x0000000010091000-memory.dmp

Download