972aeebf97a17a1798b056d653ee84842778fdd6ec72d7e3641f93171204024b

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 09:05

Target

8bf0dfa26f6683abba8a8a6d0e146734.dll
Size

44KB
MD5

8bf0dfa26f6683abba8a8a6d0e146734
SHA1

02a7447391ab352c0a3f3bc8d3850c23bccb3d3f
SHA256

972aeebf97a17a1798b056d653ee84842778fdd6ec72d7e3641f93171204024b
SHA512

58019bd4a13e0513219ddf5d5dc014810bb9dd4acda3d97dc6463b224b2307bba8b008a4cc58febde84f0d52cdf986e8da7678019925a415e177959e0de71fea
SSDEEP

768:F7daui9stYzFSB2p7apkguPcr7Hp4Z0xWe8BwRE0bl5qtGtOIj+Ig1a9IEM21cj:L1i9stYJSB2p7aSHPmq1e8BwR8+qIg95

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/896-0-0x0000000010000000-0x0000000010025000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 896	4640	regsvr32.exe	84
PID 4640 wrote to memory of 896	4640	regsvr32.exe	84
PID 4640 wrote to memory of 896	4640	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8bf0dfa26f6683abba8a8a6d0e146734.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8bf0dfa26f6683abba8a8a6d0e146734.dll
  2⤵
  PID:896

memory/896-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download