svcready | b9326a2a37919473a7c24dbacea646532408bc6dad87702ab2fe32cd8a80760e

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-08-2022 15:38

Target

14756d31fc0b5473735688183642cfc4.dll
Size

1.6MB
MD5

14756d31fc0b5473735688183642cfc4
SHA1

f2d2099c9d54b832e59f46e8035d4c2ca7094ef6
SHA256

b9326a2a37919473a7c24dbacea646532408bc6dad87702ab2fe32cd8a80760e
SHA512

2617245cad2777a50abf4c9e45d64b945460ef8dfd06e908dbbefcdeecabca8d4b7e73ab17c33569897e4d457b19c25fa277d153ab515ada0d4defb07281de7d

Score

10^/10

svcready loader

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral1/memory/1728-57-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	1728	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1728	1316	regsvr32.exe	26
PID 1316 wrote to memory of 1728	1316	regsvr32.exe	26
PID 1316 wrote to memory of 1728	1316	regsvr32.exe	26
PID 1316 wrote to memory of 1728	1316	regsvr32.exe	26
PID 1316 wrote to memory of 1728	1316	regsvr32.exe	26
PID 1316 wrote to memory of 1728	1316	regsvr32.exe	26
PID 1316 wrote to memory of 1728	1316	regsvr32.exe	26
PID 1728 wrote to memory of 1224	1728	regsvr32.exe	27
PID 1728 wrote to memory of 1224	1728	regsvr32.exe	27
PID 1728 wrote to memory of 1224	1728	regsvr32.exe	27
PID 1728 wrote to memory of 1224	1728	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\14756d31fc0b5473735688183642cfc4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\14756d31fc0b5473735688183642cfc4.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 300
    3⤵
    - Program crash
    PID:1224

memory/1316-54-0x000007FEFB941000-0x000007FEFB943000-memory.dmp

Filesize
8KB

Download
memory/1728-56-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1728-57-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download