cce0e105623807bf85e2329f32ae23bcfea83bdbc812ba31fadab49fda28c61a

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 00:01

Target

3e35303282dc79fa303efb3586eb1b48.dll
Size

718KB
MD5

3e35303282dc79fa303efb3586eb1b48
SHA1

22c24bf37aeb5b356b4bc7069d18d5d249eeb720
SHA256

cce0e105623807bf85e2329f32ae23bcfea83bdbc812ba31fadab49fda28c61a
SHA512

a37f7dd7b87fde6bf5c510432277b66d74eabdd38a355ca679a5f6e3aa0ce2a49d34b665c9697f91f2558a16c2c7abfa94ff8e45fb1b4b5e8cfe7173a258af67
SSDEEP

12288:l+ir5OKM/Qznrp8yd8K1TpWMzeWAZ5LJTJVMpnErC5fm8Ivto/cGYGCoMCIog:lwrozn7d8Gs5WWhMpnKor2EOGjMX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3036-0-0x00000000022A0000-0x000000000310D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3036	2992	regsvr32.exe	28
PID 2992 wrote to memory of 3036	2992	regsvr32.exe	28
PID 2992 wrote to memory of 3036	2992	regsvr32.exe	28
PID 2992 wrote to memory of 3036	2992	regsvr32.exe	28
PID 2992 wrote to memory of 3036	2992	regsvr32.exe	28
PID 2992 wrote to memory of 3036	2992	regsvr32.exe	28
PID 2992 wrote to memory of 3036	2992	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3e35303282dc79fa303efb3586eb1b48.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3e35303282dc79fa303efb3586eb1b48.dll
  2⤵
  PID:3036

memory/3036-0-0x00000000022A0000-0x000000000310D000-memory.dmp

Filesize
14.4MB

Download
memory/3036-1-0x00000000022A0000-0x000000000310D000-memory.dmp

Filesize
14.4MB

Download