egregor | 3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04

Analysis

max time kernel
85s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 17:38

Target

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
Size

781KB
MD5

56a6ffe6a02941028cc8235204eef31d
SHA1

5d30c56e46d627a0ac97097faa0eed6346b5d104
SHA256

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04
SHA512

83ba076efd48bbe7d90479a05f16ebccbee4e8574a18f2e215b598d1bd51b0f05329e4b5a247099859c77e79c019ac6cf3dad63159ddd3c284280e41ebebe8d5
SSDEEP

12288:eTouwVL81LNdljx5t6nPGebJeTzVA7lOnVhNU:codKjx5i7dOH

Score

10^/10

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3680 wrote to memory of 4376	3680	regsvr32.exe	regsvr32.exe
PID 3680 wrote to memory of 4376	3680	regsvr32.exe	regsvr32.exe
PID 3680 wrote to memory of 4376	3680	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
2⤵
PID:4376

memory/4376-132-0x0000000000000000-mapping.dmp

Download
memory/4376-133-0x00000000008B0000-0x00000000008EF000-memory.dmp

Filesize
252KB

Download
memory/4376-139-0x00000000008B0000-0x00000000008EF000-memory.dmp

Filesize
252KB

Download