svcready | 826103395ef4d9e9a5c3fd9d4acf0e92fc7b334b3529d227570909ca8ce2c150

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/08/2022, 15:35

Target
b14416e5dc3d8268b6817297f442465f.dll
Size 1.3MB
Sample220815-s1bvxafch8
SHA256 826103395ef4d9e9a5c3fd9d4acf0e92fc7b334b3529d227570909ca8ce2c150
MD5 b14416e5dc3d8268b6817297f442465f
SHA1 d763781121359fb614804f874c373d6fa12b4a27
SHA512 fcea7c2bdaebca25dfcb8aa67d8ed35259d309a97e6f625278dd8bdb23a069b3d0c817da5ddff7d2a038d79dc98c50dfaf51719a138aafb61665f2e70d3aacf8
MD5 SHA1 SHA512

Score

10^/10

svcready loader

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/1672-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	1672	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1672	1816	regsvr32.exe	26
PID 1816 wrote to memory of 1672	1816	regsvr32.exe	26
PID 1816 wrote to memory of 1672	1816	regsvr32.exe	26
PID 1816 wrote to memory of 1672	1816	regsvr32.exe	26
PID 1816 wrote to memory of 1672	1816	regsvr32.exe	26
PID 1816 wrote to memory of 1672	1816	regsvr32.exe	26
PID 1816 wrote to memory of 1672	1816	regsvr32.exe	26
PID 1672 wrote to memory of 1916	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1916	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1916	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1916	1672	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b14416e5dc3d8268b6817297f442465f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b14416e5dc3d8268b6817297f442465f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 300
    3⤵
    - Program crash
    PID:1916

memory/1672-56-0x0000000075FA1000-0x0000000075FA3000-memory.dmp

Download

memory/1672-57-0x0000000010000000-0x0000000010091000-memory.dmp

Download

memory/1816-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Download