ca8ceb8b6c61264570e5b97b8f70b67357eedd338e1c9f63f5c2c860491a1f93 | Triage

Analysis

max time kernel
0s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:24

Sharing

Report Analysis Logs

General

Target

10b45aded1001c76b5fd05b88491e06a.dll
Size

106KB
MD5

10b45aded1001c76b5fd05b88491e06a
SHA1

1aa2bcc9fe688d734c5a8c6840b6e0f2a3de74eb
SHA256

ca8ceb8b6c61264570e5b97b8f70b67357eedd338e1c9f63f5c2c860491a1f93
SHA512

545a40c4f4491389a9ecf75810dd41db9fbb8771fc85f72f10a29db1365bdf102ffc383cde42f4e4f52c4ac352343589bc692ce9186b115eca4dc4508a1aeac2
SSDEEP

3072:fTy1wyNXiEdfy7sF2Ud1MHF/o07q772FY3O:fTy6yXiEdhF5WH9o0G7J3O

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2936-0-0x0000000010000000-0x000000001003A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2936	2652	regsvr32.exe	16
PID 2652 wrote to memory of 2936	2652	regsvr32.exe	16
PID 2652 wrote to memory of 2936	2652	regsvr32.exe	16
PID 2652 wrote to memory of 2936	2652	regsvr32.exe	16
PID 2652 wrote to memory of 2936	2652	regsvr32.exe	16
PID 2652 wrote to memory of 2936	2652	regsvr32.exe	16
PID 2652 wrote to memory of 2936	2652	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\10b45aded1001c76b5fd05b88491e06a.dll
1⤵
PID:2936

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\10b45aded1001c76b5fd05b88491e06a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/2936-3-0x0000000000371000-0x000000000039E000-memory.dmp

Filesize
180KB

Download
memory/2936-1-0x0000000000370000-0x00000000003A3000-memory.dmp

Filesize
204KB

Download