5854c65f341736f51083ab9683abba04e3fa64bdf42beee5c2513b523a369bd1

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 13:45

Target

bb69b00cf0300074269336c33c3b1a9b.dll
Size

83KB
MD5

bb69b00cf0300074269336c33c3b1a9b
SHA1

7561876785c8f69afb38dfeaf5915fbc7944c936
SHA256

5854c65f341736f51083ab9683abba04e3fa64bdf42beee5c2513b523a369bd1
SHA512

20f5af5b4b9889a71d2ffd0b8f659304e855e550e286e7bd92151d7369dd48ffa5fa10771569e55dc503a85a5a459d4f642b3ad0834f29851a40cc0f4ccf9639
SSDEEP

1536:Af5ekY4O0LboSNBrkwQLfVzFSN8g8sDrAI6VkZua+PydhlDmsMxQ/Av:Af8kYYboSLkwsZSND8EjZuaHdhJwxQ/A

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1740-1-0x0000000000170000-0x00000000001AE000-memory.dmp	upx
behavioral1/memory/1740-3-0x0000000000170000-0x00000000001AE000-memory.dmp	upx
behavioral1/memory/1740-4-0x0000000000170000-0x00000000001AE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1740	1280	regsvr32.exe	28
PID 1280 wrote to memory of 1740	1280	regsvr32.exe	28
PID 1280 wrote to memory of 1740	1280	regsvr32.exe	28
PID 1280 wrote to memory of 1740	1280	regsvr32.exe	28
PID 1280 wrote to memory of 1740	1280	regsvr32.exe	28
PID 1280 wrote to memory of 1740	1280	regsvr32.exe	28
PID 1280 wrote to memory of 1740	1280	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb69b00cf0300074269336c33c3b1a9b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bb69b00cf0300074269336c33c3b1a9b.dll
  2⤵
  PID:1740

memory/1740-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/1740-1-0x0000000000170000-0x00000000001AE000-memory.dmp

Filesize
248KB

Download
memory/1740-3-0x0000000000170000-0x00000000001AE000-memory.dmp

Filesize
248KB

Download
memory/1740-4-0x0000000000170000-0x00000000001AE000-memory.dmp

Filesize
248KB

Download