57761d6896cb3313495222948035e0c623c103f404795db83202f5a08b7451ac

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 11:28

Target

cb4a4ac976840e8a84711aeac6aae76f.dll
Size

38KB
MD5

cb4a4ac976840e8a84711aeac6aae76f
SHA1

71bf7b6243d1e8c97824d2d4ba82e67da54b1f1f
SHA256

57761d6896cb3313495222948035e0c623c103f404795db83202f5a08b7451ac
SHA512

9cdaaf80f1f36068a845bc22cc18745547f35e5c432d0321118847c3548095d9dd1b4d09b64829df4af52ee93f4f0686521be8d1ac8e666cd0314eba54d1c9b7
SSDEEP

768:O9GBkGdsCsnnnnFcirgeEifEoqe8lrEFbyPboAQBigQraqeaPZ6GduHnnnnnnob0:4GFdslnnnn2iN5feeyPbcBdQraqeaPZW

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2968-1-0x0000000000F10000-0x0000000000F31000-memory.dmp	upx
behavioral2/memory/2968-3-0x0000000000F10000-0x0000000000F31000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2968	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2968	2392	regsvr32.exe	89
PID 2392 wrote to memory of 2968	2392	regsvr32.exe	89
PID 2392 wrote to memory of 2968	2392	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb4a4ac976840e8a84711aeac6aae76f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cb4a4ac976840e8a84711aeac6aae76f.dll
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 632
    3⤵
    - Program crash
    PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2968 -ip 2968
1⤵
PID:4840

memory/2968-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2968-1-0x0000000000F10000-0x0000000000F31000-memory.dmp

Filesize
132KB

Download
memory/2968-3-0x0000000000F10000-0x0000000000F31000-memory.dmp

Filesize
132KB

Download