b9fe0e1f55f45e2bc7f14e999d992f2b956dc334352e68c4279e3fb55b9cceb6

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 08:42

Target

b9fe0e1f55f45e2bc7f14e999d992f2b956dc334352e68c4279e3fb55b9cceb6.dll
Size

17KB
MD5

6b13f147fac7dfa30e7a618fb25f3a40
SHA1

27fcb6b6b992fd6444a61b4a971d35be03a13727
SHA256

b9fe0e1f55f45e2bc7f14e999d992f2b956dc334352e68c4279e3fb55b9cceb6
SHA512

2bb77276b5b2788a893fadbaa2e53087ef6ab69704b8385ab1321c7634384670b4207c76f061e3b54cbffe7b1884e6b3c81075e6d6d8da372b18540412464284
SSDEEP

384:NEDVanAjh93zEb9Xt47Y/P0cGpyp8QqHxXeusOz:NEDVT93zEpXm03OpyprGLHz

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2252-133-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2252	3536	regsvr32.exe	83
PID 3536 wrote to memory of 2252	3536	regsvr32.exe	83
PID 3536 wrote to memory of 2252	3536	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b9fe0e1f55f45e2bc7f14e999d992f2b956dc334352e68c4279e3fb55b9cceb6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b9fe0e1f55f45e2bc7f14e999d992f2b956dc334352e68c4279e3fb55b9cceb6.dll
  2⤵
  PID:2252

memory/2252-132-0x0000000000000000-mapping.dmp

Download
memory/2252-133-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download