svcready | b9326a2a37919473a7c24dbacea646532408bc6dad87702ab2fe32cd8a80760e | Triage™

Analysis

max time kernel
101s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2022, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14756d31fc0b5473735688183642cfc4.dll
Size 1.6MB
Sample220815-s22gysfdb7
SHA256 b9326a2a37919473a7c24dbacea646532408bc6dad87702ab2fe32cd8a80760e
MD5 14756d31fc0b5473735688183642cfc4
SHA1 f2d2099c9d54b832e59f46e8035d4c2ca7094ef6
SHA512 2617245cad2777a50abf4c9e45d64b945460ef8dfd06e908dbbefcdeecabca8d4b7e73ab17c33569897e4d457b19c25fa277d153ab515ada0d4defb07281de7d
MD5 SHA1 SHA512

Score

10^/10

svcready loader

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

resource	yara_rule
behavioral2/memory/3320-133-0x0000000010000000-0x0000000010091000-memory.dmp	family_svcready

SVCReady
SVCReady is a malware loader first seen in April 2022.
loader svcready

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 3320	1268	regsvr32.exe	81
PID 1268 wrote to memory of 3320	1268	regsvr32.exe	81
PID 1268 wrote to memory of 3320	1268	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\14756d31fc0b5473735688183642cfc4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\14756d31fc0b5473735688183642cfc4.dll
  2⤵
  PID:3320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3320-133-0x0000000010000000-0x0000000010091000-memory.dmp

Download