23e3c686cb2524acdd38a65676a273d0cde21b3730a61daddb96d492de8e5289

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:57

Target

1b29f904332c334285722abf6f17377c.dll
Size

332KB
MD5

1b29f904332c334285722abf6f17377c
SHA1

1e916371703502429843f0d6e7a1aedb0ab5e8ce
SHA256

23e3c686cb2524acdd38a65676a273d0cde21b3730a61daddb96d492de8e5289
SHA512

25c2c6d7879a3fb5dcea1b167f78e74abb70c9e053140ec26d1ca6d09994e031882b9523a88883a43569f761ff7cdeb0b9dfd49d106d5c9fb8b5c0dcb0eba9ef
SSDEEP

6144:aOuDz+ZOf9ApGvxMa6e93kEi6LyHbGX6SNT7UcrDM+:aOuag9ApGvxtneEXFRNDrI

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2752	regsvr32Srv.exe

Loads dropped DLL 2 IoCs

pid	Process
2656	regsvr32.exe
2656	regsvr32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000c0000000122bb-2.dat	upx
behavioral1/memory/2656-3-0x00000000001A0000-0x00000000001E1000-memory.dmp	upx
behavioral1/memory/2752-11-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2752-10-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32Srv.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2656	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2656	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2656	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2656	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2656	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2656	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2656	2024	regsvr32.exe	28
PID 2656 wrote to memory of 2752	2656	regsvr32.exe	29
PID 2656 wrote to memory of 2752	2656	regsvr32.exe	29
PID 2656 wrote to memory of 2752	2656	regsvr32.exe	29
PID 2656 wrote to memory of 2752	2656	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b29f904332c334285722abf6f17377c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b29f904332c334285722abf6f17377c.dll
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\regsvr32Srv.exe
    C:\Windows\SysWOW64\regsvr32Srv.exe
    3⤵
    - Executes dropped EXE
    PID:2752

\Windows\SysWOW64\regsvr32Srv.exe

Filesize
62KB

MD5
6640058e9c45b96532f59c0c7775137f

SHA1
a31457cafe09d4e182ec88466fda3fbff9f84c18

SHA256
2f7b493a15bee1f1130d20c9deba402215e6c63be070de78b8435f73cf530e1b

SHA512
3d2e0f687ca99f0e8e59e2fc733b83ed50ca2b74ca82e6959585eb14dd71e94f28f92c6c3db279487530ec1f21c8e70c79b66ce5ddc0636facd4c4c85309eb0d

Download Submit
memory/2656-1-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2656-3-0x00000000001A0000-0x00000000001E1000-memory.dmp

Filesize
260KB

Download
memory/2752-11-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2752-10-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2752-12-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2752-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download