972aeebf97a17a1798b056d653ee84842778fdd6ec72d7e3641f93171204024b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 09:05

Target

8bf0dfa26f6683abba8a8a6d0e146734.dll
Size

44KB
MD5

8bf0dfa26f6683abba8a8a6d0e146734
SHA1

02a7447391ab352c0a3f3bc8d3850c23bccb3d3f
SHA256

972aeebf97a17a1798b056d653ee84842778fdd6ec72d7e3641f93171204024b
SHA512

58019bd4a13e0513219ddf5d5dc014810bb9dd4acda3d97dc6463b224b2307bba8b008a4cc58febde84f0d52cdf986e8da7678019925a415e177959e0de71fea
SSDEEP

768:F7daui9stYzFSB2p7apkguPcr7Hp4Z0xWe8BwRE0bl5qtGtOIj+Ig1a9IEM21cj:L1i9stYJSB2p7aSHPmq1e8BwR8+qIg95

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1884-0-0x0000000010000000-0x0000000010025000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1884	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1884	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1884	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1884	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1884	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1884	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1884	1940	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8bf0dfa26f6683abba8a8a6d0e146734.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8bf0dfa26f6683abba8a8a6d0e146734.dll
  2⤵
  PID:1884

memory/1884-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download