3a789a9834c4e1b42d7c8dff019fc58ae7ece70554ab16ff3610d22ddee3fd3a

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:56

Target

17bad077379cd959607cd0765c1da797.dll
Size

70KB
MD5

17bad077379cd959607cd0765c1da797
SHA1

505b6ec21bd41eca0ed96f832f64ef33e2b29bbe
SHA256

3a789a9834c4e1b42d7c8dff019fc58ae7ece70554ab16ff3610d22ddee3fd3a
SHA512

770f582baa762f22beee98ded16267756ab1aaef692db5f6a07c333c42eacb8d6d18ba0048738a03122c43b071b00f70bac83db96ef750b9d95e683bb85e08a6
SSDEEP

1536:1XLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnout:1XLwt/FiaU1Uq/dWFbNr8azD7VS372oS

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3688-0-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/3688-1-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/3688-4-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4596	3688	WerFault.exe	89
4768	3688	WerFault.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3688	4744	regsvr32.exe	89
PID 4744 wrote to memory of 3688	4744	regsvr32.exe	89
PID 4744 wrote to memory of 3688	4744	regsvr32.exe	89
PID 3688 wrote to memory of 4596	3688	regsvr32.exe	93
PID 3688 wrote to memory of 4596	3688	regsvr32.exe	93
PID 3688 wrote to memory of 4596	3688	regsvr32.exe	93

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\17bad077379cd959607cd0765c1da797.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\17bad077379cd959607cd0765c1da797.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 660
    3⤵
    - Program crash
    PID:4596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 660
    3⤵
    - Program crash
    PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3688 -ip 3688
1⤵
PID:3656

memory/3688-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3688-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3688-4-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download