buer | bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9

Analysis

max time kernel
8s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 14:44

Target

bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9.dll
Size

789KB
MD5

4c6d461e3d54cb8c31a7583ff4d891ea
SHA1

febafa00a2ca1cfd96705c3341dc10dde880dee9
SHA256

bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9
SHA512

506363f19e380db162fcd7e68c267b7606b474e3c4407dc10ceff26295f022813cd080413bc6a7ec47f957e70134156a453ab6b69696ef3c80155f11ff5fb841
SSDEEP

12288:Gl5wn1tqJdEJcFxTzmevkYKViWQRoITdOCsljq:GTwn1tbGFxTzmevkYK5QG

Score

10^/10

buer loader

Family

buer

mirrorsoffecalbank.com

Buer Loader 1 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/1380-58-0x0000000000C00000-0x0000000000ECA000-memory.dmp	buer

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1380	848	regsvr32.exe	27
PID 848 wrote to memory of 1380	848	regsvr32.exe	27
PID 848 wrote to memory of 1380	848	regsvr32.exe	27
PID 848 wrote to memory of 1380	848	regsvr32.exe	27
PID 848 wrote to memory of 1380	848	regsvr32.exe	27
PID 848 wrote to memory of 1380	848	regsvr32.exe	27
PID 848 wrote to memory of 1380	848	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9.dll
  2⤵
  PID:1380

memory/848-54-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1380-57-0x0000000000C00000-0x0000000000ECA000-memory.dmp

Filesize
2.8MB

Download
memory/1380-58-0x0000000000C00000-0x0000000000ECA000-memory.dmp

Filesize
2.8MB

Download