f8c193dbb8bfabe66a7d9d2a50e0eaed06c12341a71b78c1bd195846c463af6d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 16:42

Target

传奇辅助工具/plugin/DBPOP.dll
Size

48KB
MD5

20aa3b73a2afd0fc487e6a8c29d4bb6d
SHA1

8462c20a52d949d487fcff1ed0799cbe92ee08f7
SHA256

f7af6a1de3af4dda3c19926e905654fbac70a7ca80eb52d9e092a50398df5919
SHA512

df095d982976e8354df500b391077f2e637e9eb8362179f5ac64ee7839082affe6a5e88ab6b5727423a6ef3b9b7b4644710844583c18922b2313eb2189952878
SSDEEP

768:iC36X+zl2JkBjjCFUybUV1jhb7iBPibLe+YuUgTOgpjnzYhfK+GJ5fCb3fN0v5nN:T3W+zl9vAo77iZivebuUEOgFt+q5fCbG

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/2916-0-0x0000000011000000-0x0000000011041000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2916	2896	regsvr32.exe	28
PID 2896 wrote to memory of 2916	2896	regsvr32.exe	28
PID 2896 wrote to memory of 2916	2896	regsvr32.exe	28
PID 2896 wrote to memory of 2916	2896	regsvr32.exe	28
PID 2896 wrote to memory of 2916	2896	regsvr32.exe	28
PID 2896 wrote to memory of 2916	2896	regsvr32.exe	28
PID 2896 wrote to memory of 2916	2896	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\传奇辅助工具\plugin\DBPOP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\传奇辅助工具\plugin\DBPOP.dll
  2⤵
  PID:2916

memory/2916-0-0x0000000011000000-0x0000000011041000-memory.dmp

Filesize
260KB

Download