94f53669bcad6d66c040270c760302275cf89964a94cadc0c176f8e61e6a5896

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 19:56

Target

94f53669bcad6d66c040270c760302275cf89964a94cadc0c176f8e61e6a5896.dll
Size

53KB
MD5

a3914111ee45bb06172ae329bde82270
SHA1

e902860a8b896b61a8344eed54d20d94d02d972b
SHA256

94f53669bcad6d66c040270c760302275cf89964a94cadc0c176f8e61e6a5896
SHA512

8c3a0aee5b2633547cf9eee50d3df6773b8913e2f03a90c9151f2e0d409fd3f341551f2f74d6b0be31269be05c17824024cf45da37935b649ca3562d678382a1
SSDEEP

1536:QtdzXJurc90zeJM+CrmutBKtehLl+flch:sdNhJ98BYeylch

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1068-57-0x0000000010000000-0x000000001002B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1068	576	regsvr32.exe	26
PID 576 wrote to memory of 1068	576	regsvr32.exe	26
PID 576 wrote to memory of 1068	576	regsvr32.exe	26
PID 576 wrote to memory of 1068	576	regsvr32.exe	26
PID 576 wrote to memory of 1068	576	regsvr32.exe	26
PID 576 wrote to memory of 1068	576	regsvr32.exe	26
PID 576 wrote to memory of 1068	576	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\94f53669bcad6d66c040270c760302275cf89964a94cadc0c176f8e61e6a5896.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\94f53669bcad6d66c040270c760302275cf89964a94cadc0c176f8e61e6a5896.dll
  2⤵
  PID:1068

memory/576-54-0x000007FEFBF01000-0x000007FEFBF03000-memory.dmp

Filesize
8KB

Download
memory/1068-56-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/1068-57-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download