5e4ff03a3236a13c72f382193ce629dff3964ac39bf6b5ed5075ce77b5f8e776

Analysis

max time kernel
138s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 03:33

Target

2682e14d60f91e78f8da9d6a79475e34.dll
Size

64KB
MD5

2682e14d60f91e78f8da9d6a79475e34
SHA1

1403ca97f4bfe764695e463f8fb0b3fd16dbee62
SHA256

5e4ff03a3236a13c72f382193ce629dff3964ac39bf6b5ed5075ce77b5f8e776
SHA512

7e2a59068ddb721639d098eb662a70476bad471c68cc430372d2c93dad51fdf385c61b7d582f3448418359828ad9f1c256b039dbc24e9d046f9bc9b0969d9cfc
SSDEEP

768:CUhWyTnr2nveO42m3+NxEXBr0ze9hSRye8QPw137P7ju:CUhzTn6nvs2muNiRFrSRyeoR7DS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5040-0-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral2/memory/5040-1-0x0000000010000000-0x0000000010010000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	5040	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 5040	1908	regsvr32.exe	90
PID 1908 wrote to memory of 5040	1908	regsvr32.exe	90
PID 1908 wrote to memory of 5040	1908	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2682e14d60f91e78f8da9d6a79475e34.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2682e14d60f91e78f8da9d6a79475e34.dll
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 660
    3⤵
    - Program crash
    PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5040 -ip 5040
1⤵
PID:2252

memory/5040-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5040-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download