Analysis
-
max time kernel
48s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-08-2022 17:24
Behavioral task
behavioral1
Sample
f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll
-
Size
144KB
-
MD5
b61fc9a022e91ce3b16b5ee134c7006f
-
SHA1
f16f25c494f48cd922b587a8d14ee0ca5e20580a
-
SHA256
f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea
-
SHA512
10c10d0c84daf7233f835ef4f384b8daf26c811d2ec45c92cb32fad2fa720206fe5a302e1591c9b2baec578dcd534201cf7bce7451d91f8cff12b7223d1a7069
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1176 wrote to memory of 828 1176 regsvr32.exe 26 PID 1176 wrote to memory of 828 1176 regsvr32.exe 26 PID 1176 wrote to memory of 828 1176 regsvr32.exe 26 PID 1176 wrote to memory of 828 1176 regsvr32.exe 26 PID 1176 wrote to memory of 828 1176 regsvr32.exe 26 PID 1176 wrote to memory of 828 1176 regsvr32.exe 26 PID 1176 wrote to memory of 828 1176 regsvr32.exe 26
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll2⤵PID:828
-