egregor | 3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 19:03 UTC

Target

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
Size

781KB
MD5

56a6ffe6a02941028cc8235204eef31d
SHA1

5d30c56e46d627a0ac97097faa0eed6346b5d104
SHA256

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04
SHA512

83ba076efd48bbe7d90479a05f16ebccbee4e8574a18f2e215b598d1bd51b0f05329e4b5a247099859c77e79c019ac6cf3dad63159ddd3c284280e41ebebe8d5
SSDEEP

12288:eTouwVL81LNdljx5t6nPGebJeTzVA7lOnVhNU:codKjx5i7dOH

Score

10^/10

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1228	1832	regsvr32.exe	27
PID 1832 wrote to memory of 1228	1832	regsvr32.exe	27
PID 1832 wrote to memory of 1228	1832	regsvr32.exe	27
PID 1832 wrote to memory of 1228	1832	regsvr32.exe	27
PID 1832 wrote to memory of 1228	1832	regsvr32.exe	27
PID 1832 wrote to memory of 1228	1832	regsvr32.exe	27
PID 1832 wrote to memory of 1228	1832	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
  2⤵
  PID:1228

memory/1228-56-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1228-60-0x0000000000200000-0x000000000023F000-memory.dmp

Filesize
252KB

Download
memory/1228-63-0x0000000000200000-0x0000000000280000-memory.dmp

Filesize
512KB

Download
memory/1228-64-0x0000000000200000-0x0000000000280000-memory.dmp

Filesize
512KB

Download
memory/1832-54-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

Filesize
8KB

Download