dbc32c15433ad5b88989ac63bb0674534969ad74b9b609d249e2776ddf731247

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:20

Target

752a59740844bb4e9f0dd57fc68c9f4d.dll
Size

13KB
MD5

752a59740844bb4e9f0dd57fc68c9f4d
SHA1

b77b014cf40b7b84ee6892d55cec83b68662bc1e
SHA256

dbc32c15433ad5b88989ac63bb0674534969ad74b9b609d249e2776ddf731247
SHA512

f26e5350bb303deb504c2ce6199b9bd8cbc9821bd2384de2101fc94c693915fc991a3e1bf81bed7de80abae783ceda02f2c4a7cfdc6ea4e643deb760b0f6172e
SSDEEP

192:muE2SePEIDCFD7FO5zQlTnQGnBXmSitEVojhTfOj3vFIDLEL8j:g2amQXFaQlTQGnBX7UTGj36DLE

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2112-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	2112	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2112	2360	regsvr32.exe	28
PID 2360 wrote to memory of 2112	2360	regsvr32.exe	28
PID 2360 wrote to memory of 2112	2360	regsvr32.exe	28
PID 2360 wrote to memory of 2112	2360	regsvr32.exe	28
PID 2360 wrote to memory of 2112	2360	regsvr32.exe	28
PID 2360 wrote to memory of 2112	2360	regsvr32.exe	28
PID 2360 wrote to memory of 2112	2360	regsvr32.exe	28
PID 2112 wrote to memory of 2648	2112	regsvr32.exe	29
PID 2112 wrote to memory of 2648	2112	regsvr32.exe	29
PID 2112 wrote to memory of 2648	2112	regsvr32.exe	29
PID 2112 wrote to memory of 2648	2112	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\752a59740844bb4e9f0dd57fc68c9f4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\752a59740844bb4e9f0dd57fc68c9f4d.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 332
    3⤵
    - Program crash
    PID:2648

memory/2112-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download