buer | bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9

Analysis

max time kernel
157s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 14:44

Target

bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9.dll
Size

789KB
MD5

4c6d461e3d54cb8c31a7583ff4d891ea
SHA1

febafa00a2ca1cfd96705c3341dc10dde880dee9
SHA256

bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9
SHA512

506363f19e380db162fcd7e68c267b7606b474e3c4407dc10ceff26295f022813cd080413bc6a7ec47f957e70134156a453ab6b69696ef3c80155f11ff5fb841
SSDEEP

12288:Gl5wn1tqJdEJcFxTzmevkYKViWQRoITdOCsljq:GTwn1tbGFxTzmevkYK5QG

Score

10^/10

buer loader

Family

buer

mirrorsoffecalbank.com

Buer Loader 1 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/memory/4144-133-0x0000000000400000-0x00000000006CA000-memory.dmp	buer

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4144	4900	regsvr32.exe	79
PID 4900 wrote to memory of 4144	4900	regsvr32.exe	79
PID 4900 wrote to memory of 4144	4900	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9.dll
  2⤵
  PID:4144

memory/4144-133-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download