5854c65f341736f51083ab9683abba04e3fa64bdf42beee5c2513b523a369bd1

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 13:45

Target

bb69b00cf0300074269336c33c3b1a9b.dll
Size

83KB
MD5

bb69b00cf0300074269336c33c3b1a9b
SHA1

7561876785c8f69afb38dfeaf5915fbc7944c936
SHA256

5854c65f341736f51083ab9683abba04e3fa64bdf42beee5c2513b523a369bd1
SHA512

20f5af5b4b9889a71d2ffd0b8f659304e855e550e286e7bd92151d7369dd48ffa5fa10771569e55dc503a85a5a459d4f642b3ad0834f29851a40cc0f4ccf9639
SSDEEP

1536:Af5ekY4O0LboSNBrkwQLfVzFSN8g8sDrAI6VkZua+PydhlDmsMxQ/Av:Af8kYYboSLkwsZSND8EjZuaHdhJwxQ/A

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3976-2-0x0000000000C50000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/3976-4-0x0000000000C50000-0x0000000000C8E000-memory.dmp	upx
behavioral2/memory/3976-5-0x0000000000C50000-0x0000000000C8E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
920	3976	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3976	4552	regsvr32.exe	88
PID 4552 wrote to memory of 3976	4552	regsvr32.exe	88
PID 4552 wrote to memory of 3976	4552	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb69b00cf0300074269336c33c3b1a9b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bb69b00cf0300074269336c33c3b1a9b.dll
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 684
    3⤵
    - Program crash
    PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3976 -ip 3976
1⤵
PID:3608

memory/3976-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/3976-1-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/3976-2-0x0000000000C50000-0x0000000000C8E000-memory.dmp

Filesize
248KB

Download
memory/3976-4-0x0000000000C50000-0x0000000000C8E000-memory.dmp

Filesize
248KB

Download
memory/3976-5-0x0000000000C50000-0x0000000000C8E000-memory.dmp

Filesize
248KB

Download