4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d

Analysis

max time kernel
144s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:18

Target

4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d.dll
Size

75KB
MD5

5f31e4ad121db2276f493eb6e35d6cd0
SHA1

2e32081f53f37fe94142d16b7499a928a7b096c5
SHA256

4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d
SHA512

a85408ff8f07deb1d06c957c376ba33be6e1274eda99c1eb33b0102083838f4416f31d40acf32d93dedea8f98ef77c389c23b08334f96d66d16d89fb5433ab15
SSDEEP

1536:eKEUyvvuTXZFmA/CTUBxbClQUlwdk4RE3krgATps:7WvuTXtZGlQRdk4RBrgd

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/868-133-0x0000000010000000-0x0000000010037000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1292 868 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1292	868	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4832 wrote to memory of 868	4832	regsvr32.exe	regsvr32.exe
PID 4832 wrote to memory of 868	4832	regsvr32.exe	regsvr32.exe
PID 4832 wrote to memory of 868	4832	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d.dll
2⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 596
3⤵
- Program crash
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 868 -ip 868
1⤵
PID:1408

memory/868-132-0x0000000000000000-mapping.dmp

Download
memory/868-133-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download