cf3f59d191602570a4710d4bc1baf4c9c2a104c8318acb60d422a60c4d100f01

Analysis

max time kernel
115s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 18:21

Target

7dae8e4ecad9b20434c2277618f8640c.dll
Size

50KB
MD5

7dae8e4ecad9b20434c2277618f8640c
SHA1

059141ebad09c8ddb421dc6deb8684d0c5b42106
SHA256

cf3f59d191602570a4710d4bc1baf4c9c2a104c8318acb60d422a60c4d100f01
SHA512

81d97d10368a6148d4013b45ed8280576d95051168b0da35e879fede9581e578d1441e293144290d761e1d19634d9234dcf8471f50e4505b6be1b419ae13d9b4
SSDEEP

768:3CTFunAU5yp3Z3qfkAJnAdFQtf86iKBHzuE6/deeOT9e4K0KAY:3TAUIlc9JAUt/iaiE6LOT9eP0

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2620-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2620	4792	regsvr32.exe	86
PID 4792 wrote to memory of 2620	4792	regsvr32.exe	86
PID 4792 wrote to memory of 2620	4792	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7dae8e4ecad9b20434c2277618f8640c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7dae8e4ecad9b20434c2277618f8640c.dll
  2⤵
  PID:2620

memory/2620-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download