2c0bd1cbef18709fb8aa777b721e1f5e88c073310aed48d926821844c0fcf396

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 03:59

Target
daa2e9dfe7c0da9230044a96fee97226.dll
Size 89KB
Sample240321-ej877acf4t
SHA256 2c0bd1cbef18709fb8aa777b721e1f5e88c073310aed48d926821844c0fcf396
MD5 daa2e9dfe7c0da9230044a96fee97226
SHA1 6ea7b7ced77c51570621e4790cd29616ccbfbe86
SHA512 91677e354e9840c94cbd7f5bb8001ffb493ef5117712b248696f04868a52fdd10a47a135499a8c44964ae5a165985788c6b7cc2ec9be9d8e2eb44bc928303d8a
SSDEEP 1536:z6c2bcATlbcKNyRAOj96wsn4ElgCXQvWxuD1c/oZEOcWd8NA91Tgu0bKVDbhcpl:zkI0tvwjsRKCXQE41moqOcg8q91kAm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 3152	1020	regsvr32.exe	88
PID 1020 wrote to memory of 3152	1020	regsvr32.exe	88
PID 1020 wrote to memory of 3152	1020	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\daa2e9dfe7c0da9230044a96fee97226.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\daa2e9dfe7c0da9230044a96fee97226.dll
  2⤵
  PID:3152

memory/3152-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download