svcready | 826103395ef4d9e9a5c3fd9d4acf0e92fc7b334b3529d227570909ca8ce2c150 | Triage

Analysis

max time kernel
103s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2022, 15:35 UTC

Sharing

Report Analysis Logs

General

Target

b14416e5dc3d8268b6817297f442465f.dll
Size

1.3MB
MD5

b14416e5dc3d8268b6817297f442465f
SHA1

d763781121359fb614804f874c373d6fa12b4a27
SHA256

826103395ef4d9e9a5c3fd9d4acf0e92fc7b334b3529d227570909ca8ce2c150
SHA512

fcea7c2bdaebca25dfcb8aa67d8ed35259d309a97e6f625278dd8bdb23a069b3d0c817da5ddff7d2a038d79dc98c50dfaf51719a138aafb61665f2e70d3aacf8

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral2/memory/4740-133-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4740	456	regsvr32.exe	80
PID 456 wrote to memory of 4740	456	regsvr32.exe	80
PID 456 wrote to memory of 4740	456	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b14416e5dc3d8268b6817297f442465f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b14416e5dc3d8268b6817297f442465f.dll
  2⤵
  PID:4740

Network

No results found

209.197.3.8:80

322 B
7
209.197.3.8:80

322 B
7
20.189.173.4:443

322 B
7
87.248.202.1:80

322 B
7
87.248.202.1:80

322 B
7
87.248.202.1:80

322 B
7

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-133-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download