c37a5bd22e9a2565e57e81ce8d97a8d6aa17633ad819607f34ea924d00f9944e | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00113722_XP_Vista_7/ISSetup.dll
Size

539KB
MD5

708814a62ba813cea1a94bb77d68195b
SHA1

39c99a215751832481dc9b2ac2d6dbb17435195d
SHA256

999c523b3e43f399966a49f3caeb2a7d8ccb39d5911dfe71fd15a6a0aa2b87fe
SHA512

426cd1a12e42212ff541b3bd9c239282d548596487929b17c657056958d71a77fce209c5daa606af4d0eb6c5f74779b6d332997d00e71f6ec80fd18407c57bd3
SSDEEP

12288:Ve69Ayq/4aPisKA/pl2HM+yUN8IU03ynJNCBa7L:8OAyCPL2HM+yU8TnJMBa3

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/2192-0-0x0000000010000000-0x0000000010197000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2192	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2192	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2192	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2192	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2192	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2192	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2192	1632	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00113722_XP_Vista_7\ISSetup.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00113722_XP_Vista_7\ISSetup.dll
  2⤵
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000010000000-0x0000000010197000-memory.dmp

Filesize
1.6MB

Download