524dcb56f01cd28944c19cc78b7bca8825d50bf2cb9ef07658e46c4b919769be

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 04:07

Target

a0e862843aa79f1e543a3d6ec1925fbe.dll
Size

84KB
MD5

a0e862843aa79f1e543a3d6ec1925fbe
SHA1

f643c35efea205477b2d0307154fb4714c4ff17e
SHA256

524dcb56f01cd28944c19cc78b7bca8825d50bf2cb9ef07658e46c4b919769be
SHA512

46ad2044fc8a754b5293b93edff9ea63bb81c09e8c36491235a28345e5cf24c3e33f5dcd102c155fd719b802427614dfa90653d98aa12155c6c924a70c963c99
SSDEEP

1536:uyjPZsKRXulEGSnfc8yx5xPD17zA0t5kXUV48T1k87H1k:uy7OOqEiXhnA0t5nrT6QVk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2300-2-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2300-9-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2300	WerFault.exe	85

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2300	4700	regsvr32.exe	85
PID 4700 wrote to memory of 2300	4700	regsvr32.exe	85
PID 4700 wrote to memory of 2300	4700	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a0e862843aa79f1e543a3d6ec1925fbe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a0e862843aa79f1e543a3d6ec1925fbe.dll
  2⤵
  - Modifies registry class
  PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 636
    3⤵
    - Program crash
    PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2300 -ip 2300
1⤵
PID:4688

memory/2300-0-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download
memory/2300-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2300-4-0x0000000001360000-0x0000000001395000-memory.dmp

Filesize
212KB

Download
memory/2300-8-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download
memory/2300-9-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download