svcready | b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef | Triage

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2022 10:19

Sharing

Report Analysis Logs

General

Target

62f232bfd829f.dll
Size

1.2MB
MD5

6afec903bc7ec0aa4529eb53e0b42ca6
SHA1

dee9d64a327a559017fcc083874b3ea7851eaa86
SHA256

b6322af0749e361f8eeb671e27617051c3f3bfdc4688aa305c250506ec04efef
SHA512

5eb8a109f2b1470d34c04632c50ce98e09dc14b7cd08d2f7be711f9c3f46552ea93f7301ec03e308036b303cb8f541410e5a39857ead9b908eec75866d8c0486

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral2/memory/4112-131-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4112	4228	regsvr32.exe	82
PID 4228 wrote to memory of 4112	4228	regsvr32.exe	82
PID 4228 wrote to memory of 4112	4228	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62f232bfd829f.dll
  2⤵
  PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4112-131-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download