7df0a30bf929b75bfb0dbbe201a98d07cd51b1f336adeac178ad3e8b802a2c5e

Analysis

max time kernel
0s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 07:31

Target

55da15165e2f0c632a0ced60a84e87d7.dll
Size

60KB
MD5

55da15165e2f0c632a0ced60a84e87d7
SHA1

22310253d25eac5e44aec61d8eafcc851d0bd25c
SHA256

7df0a30bf929b75bfb0dbbe201a98d07cd51b1f336adeac178ad3e8b802a2c5e
SHA512

212bb6a25c780940c8e4bcb641c1288003d76e6d84ef9c906666fcd929fe6d1bb80715cb2f42c23cd722fe9c4182a59a48b01354fb9ba017b3d04a1864fa6ef5
SSDEEP

384:r9bl5oyJoARzC1w4mAT+lSaJNCmlzf7J49vYr/hqJQOyVSmBZt4qiePAJr5o80lT:rJ/oG9dC/+lNNN97rE/igteP8r5o8IT

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2368-11-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/2368-12-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/files/0x000b00000001224d-2.dat	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\d15.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2064	1784	regsvr32.exe	16
PID 1784 wrote to memory of 2064	1784	regsvr32.exe	16
PID 1784 wrote to memory of 2064	1784	regsvr32.exe	16
PID 1784 wrote to memory of 2064	1784	regsvr32.exe	16
PID 1784 wrote to memory of 2064	1784	regsvr32.exe	16
PID 1784 wrote to memory of 2064	1784	regsvr32.exe	16
PID 1784 wrote to memory of 2064	1784	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\55da15165e2f0c632a0ced60a84e87d7.dll
1⤵
- Drops file in System32 directory
PID:2064
- C:\Windows\SysWOW64\d15.exe
  "C:\Windows\System32\d15.exe"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\gogotoolsSILAWO9pi.exe
  "C:\Windows\System32\gogotoolsSILAWO9pi.exe"
  2⤵
  PID:2892

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\55da15165e2f0c632a0ced60a84e87d7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

memory/2064-10-0x0000000000AA0000-0x0000000000AA7000-memory.dmp

Filesize
28KB

Download
memory/2064-9-0x0000000000AA0000-0x0000000000AA7000-memory.dmp

Filesize
28KB

Download
memory/2368-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2368-12-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download