egregor | 3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 17:38

Target

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
Size

781KB
MD5

56a6ffe6a02941028cc8235204eef31d
SHA1

5d30c56e46d627a0ac97097faa0eed6346b5d104
SHA256

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04
SHA512

83ba076efd48bbe7d90479a05f16ebccbee4e8574a18f2e215b598d1bd51b0f05329e4b5a247099859c77e79c019ac6cf3dad63159ddd3c284280e41ebebe8d5
SSDEEP

12288:eTouwVL81LNdljx5t6nPGebJeTzVA7lOnVhNU:codKjx5i7dOH

Score

10^/10

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 784 wrote to memory of 2028	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 2028	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 2028	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 2028	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 2028	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 2028	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 2028	784	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
2⤵
PID:2028

memory/784-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000000000-mapping.dmp

Download
memory/2028-56-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/2028-60-0x00000000001D0000-0x000000000020F000-memory.dmp

Filesize
252KB

Download
memory/2028-63-0x00000000001D0000-0x0000000000250000-memory.dmp

Filesize
512KB

Download