300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12

Analysis

max time kernel
1370s
max time network
1165s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
27/02/2024, 09:42

Target
atiagentCozyBear.dll
Size 52KB
Sample240227-lpd3kade66
SHA256 43cd9ef6904c35c6854bf59d99731a05048af9e870261064a255db0181930fad
MD5 452ee2968ec82c7e30c21c828b330c17
SHA1 00384c359e2931fb922b034fca2707e1b2a25396
SHA512 bef788d69d8d75579cbf6499b4c2aec7c413cc56fea2a51efc4dc7742f52648fff3b64b78b3d8544d81ee473472521d352f931b56564a88031c5116444b65926
SSDEEP 768:5mXbwhMxIYGvy6uqgFuO4IGL1VjOfTaEG9hH36PDMOKqBR4kkJmnjEDXbTvG:uOWIYG66xO4TLHOGjHqhf4kJ9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3544	2808	regsvr32.exe	81
PID 2808 wrote to memory of 3544	2808	regsvr32.exe	81
PID 2808 wrote to memory of 3544	2808	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\atiagentCozyBear.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\atiagentCozyBear.dll
  2⤵
  PID:3544