23e3c686cb2524acdd38a65676a273d0cde21b3730a61daddb96d492de8e5289

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:57

Target

1b29f904332c334285722abf6f17377c.dll
Size

332KB
MD5

1b29f904332c334285722abf6f17377c
SHA1

1e916371703502429843f0d6e7a1aedb0ab5e8ce
SHA256

23e3c686cb2524acdd38a65676a273d0cde21b3730a61daddb96d492de8e5289
SHA512

25c2c6d7879a3fb5dcea1b167f78e74abb70c9e053140ec26d1ca6d09994e031882b9523a88883a43569f761ff7cdeb0b9dfd49d106d5c9fb8b5c0dcb0eba9ef
SSDEEP

6144:aOuDz+ZOf9ApGvxMa6e93kEi6LyHbGX6SNT7UcrDM+:aOuag9ApGvxtneEXFRNDrI

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
3016	regsvr32Srv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3016-5-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral2/files/0x000200000001fafe-4.dat	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32Srv.exe	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process
1452	3016	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 2112	3460	regsvr32.exe	17
PID 3460 wrote to memory of 2112	3460	regsvr32.exe	17
PID 3460 wrote to memory of 2112	3460	regsvr32.exe	17
PID 2112 wrote to memory of 3016	2112	regsvr32.exe	26
PID 2112 wrote to memory of 3016	2112	regsvr32.exe	26
PID 2112 wrote to memory of 3016	2112	regsvr32.exe	26

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1b29f904332c334285722abf6f17377c.dll
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\regsvr32Srv.exe
  C:\Windows\SysWOW64\regsvr32Srv.exe
  2⤵
  - Executes dropped EXE
  PID:3016

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b29f904332c334285722abf6f17377c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3016 -ip 3016
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 264
1⤵
- Program crash
PID:1452

C:\Windows\SysWOW64\regsvr32Srv.exe

Filesize
62KB

MD5
6640058e9c45b96532f59c0c7775137f

SHA1
a31457cafe09d4e182ec88466fda3fbff9f84c18

SHA256
2f7b493a15bee1f1130d20c9deba402215e6c63be070de78b8435f73cf530e1b

SHA512
3d2e0f687ca99f0e8e59e2fc733b83ed50ca2b74ca82e6959585eb14dd71e94f28f92c6c3db279487530ec1f21c8e70c79b66ce5ddc0636facd4c4c85309eb0d

Download Submit
memory/2112-1-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/3016-6-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/3016-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download