egregor | 3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2022 19:03

Target

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
Size

781KB
MD5

56a6ffe6a02941028cc8235204eef31d
SHA1

5d30c56e46d627a0ac97097faa0eed6346b5d104
SHA256

3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04
SHA512

83ba076efd48bbe7d90479a05f16ebccbee4e8574a18f2e215b598d1bd51b0f05329e4b5a247099859c77e79c019ac6cf3dad63159ddd3c284280e41ebebe8d5
SSDEEP

12288:eTouwVL81LNdljx5t6nPGebJeTzVA7lOnVhNU:codKjx5i7dOH

Score

10^/10

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4404	4728	regsvr32.exe	83
PID 4728 wrote to memory of 4404	4728	regsvr32.exe	83
PID 4728 wrote to memory of 4404	4728	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04.dll
  2⤵
  PID:4404

memory/4404-133-0x0000000002A40000-0x0000000002A7F000-memory.dmp

Filesize
252KB

Download
memory/4404-139-0x0000000002A40000-0x0000000002A7F000-memory.dmp

Filesize
252KB

Download