3a789a9834c4e1b42d7c8dff019fc58ae7ece70554ab16ff3610d22ddee3fd3a

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:56

Target

17bad077379cd959607cd0765c1da797.dll
Size

70KB
MD5

17bad077379cd959607cd0765c1da797
SHA1

505b6ec21bd41eca0ed96f832f64ef33e2b29bbe
SHA256

3a789a9834c4e1b42d7c8dff019fc58ae7ece70554ab16ff3610d22ddee3fd3a
SHA512

770f582baa762f22beee98ded16267756ab1aaef692db5f6a07c333c42eacb8d6d18ba0048738a03122c43b071b00f70bac83db96ef750b9d95e683bb85e08a6
SSDEEP

1536:1XLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnout:1XLwt/FiaU1Uq/dWFbNr8azD7VS372oS

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/864-1-0x0000000000860000-0x0000000000896000-memory.dmp	upx
behavioral1/memory/864-0-0x00000000006E0000-0x0000000000716000-memory.dmp	upx
behavioral1/memory/864-3-0x00000000006E0000-0x0000000000716000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
880	864	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 864	2732	regsvr32.exe	28
PID 2732 wrote to memory of 864	2732	regsvr32.exe	28
PID 2732 wrote to memory of 864	2732	regsvr32.exe	28
PID 2732 wrote to memory of 864	2732	regsvr32.exe	28
PID 2732 wrote to memory of 864	2732	regsvr32.exe	28
PID 2732 wrote to memory of 864	2732	regsvr32.exe	28
PID 2732 wrote to memory of 864	2732	regsvr32.exe	28
PID 864 wrote to memory of 880	864	regsvr32.exe	29
PID 864 wrote to memory of 880	864	regsvr32.exe	29
PID 864 wrote to memory of 880	864	regsvr32.exe	29
PID 864 wrote to memory of 880	864	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\17bad077379cd959607cd0765c1da797.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\17bad077379cd959607cd0765c1da797.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 320
    3⤵
    - Program crash
    PID:880

memory/864-1-0x0000000000860000-0x0000000000896000-memory.dmp

Filesize
216KB

Download
memory/864-0-0x00000000006E0000-0x0000000000716000-memory.dmp

Filesize
216KB

Download
memory/864-3-0x00000000006E0000-0x0000000000716000-memory.dmp

Filesize
216KB

Download
memory/864-4-0x00000000023D0000-0x00000000024E0000-memory.dmp

Filesize
1.1MB

Download