cce0e105623807bf85e2329f32ae23bcfea83bdbc812ba31fadab49fda28c61a

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2024 00:01

Target

3e35303282dc79fa303efb3586eb1b48.dll
Size

718KB
MD5

3e35303282dc79fa303efb3586eb1b48
SHA1

22c24bf37aeb5b356b4bc7069d18d5d249eeb720
SHA256

cce0e105623807bf85e2329f32ae23bcfea83bdbc812ba31fadab49fda28c61a
SHA512

a37f7dd7b87fde6bf5c510432277b66d74eabdd38a355ca679a5f6e3aa0ce2a49d34b665c9697f91f2558a16c2c7abfa94ff8e45fb1b4b5e8cfe7173a258af67
SSDEEP

12288:l+ir5OKM/Qznrp8yd8K1TpWMzeWAZ5LJTJVMpnErC5fm8Ivto/cGYGCoMCIog:lwrozn7d8Gs5WWhMpnKor2EOGjMX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1768-0-0x0000000001FC0000-0x0000000002E2D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1768	4876	regsvr32.exe	91
PID 4876 wrote to memory of 1768	4876	regsvr32.exe	91
PID 4876 wrote to memory of 1768	4876	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3e35303282dc79fa303efb3586eb1b48.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3e35303282dc79fa303efb3586eb1b48.dll
  2⤵
  PID:1768

memory/1768-0-0x0000000001FC0000-0x0000000002E2D000-memory.dmp

Filesize
14.4MB

Download
memory/1768-1-0x0000000001FC0000-0x0000000002E2D000-memory.dmp

Filesize
14.4MB

Download