d4730206161864ce74016271dafb5cda46fe153fbf4f9ed39d1bb2d64b9fa2f5

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 02:57

Target

bfa8d7767b36a47b6b5c4439ecf2a41a.dll
Size

77KB
MD5

bfa8d7767b36a47b6b5c4439ecf2a41a
SHA1

934e1897a9ef4938d2b92e5d24b235dd07c5e88e
SHA256

d4730206161864ce74016271dafb5cda46fe153fbf4f9ed39d1bb2d64b9fa2f5
SHA512

0bd30194afd0dfe4a350980c80cae2e149ecc49628a5b4e7a2f53a8a43372bd1eb096db5ec8080ba096e871ae1aebb999e206622205788b27ab7762e4a32933f
SSDEEP

1536:9G1M3aEMQhV/N2+/jxEdNlpyVhqUcRutFFCBu0kXCGu5AQUq:0QaJQhV/jj2NghJtFFCBu0kSd5Uq

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000230000-0x000000000025B000-memory.dmp	upx
behavioral1/memory/1940-1-0x0000000000230000-0x000000000025B000-memory.dmp	upx
behavioral1/memory/1940-5-0x0000000000230000-0x000000000025B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	1940	WerFault.exe	28

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ProgID\	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1940	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1940	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1940	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1940	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1940	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1940	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1940	2200	regsvr32.exe	28
PID 1940 wrote to memory of 2508	1940	regsvr32.exe	29
PID 1940 wrote to memory of 2508	1940	regsvr32.exe	29
PID 1940 wrote to memory of 2508	1940	regsvr32.exe	29
PID 1940 wrote to memory of 2508	1940	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bfa8d7767b36a47b6b5c4439ecf2a41a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bfa8d7767b36a47b6b5c4439ecf2a41a.dll
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 316
    3⤵
    - Program crash
    PID:2508

memory/1940-0-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/1940-2-0x0000000000200000-0x000000000022E000-memory.dmp

Filesize
184KB

Download
memory/1940-1-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/1940-5-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download