c401e66d2365e5c76ebdda225020827c92c5d54cd31703c56a2730c4e66a0b9a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 08:32

Target

c401e66d2365e5c76ebdda225020827c92c5d54cd31703c56a2730c4e66a0b9a.dll
Size

36KB
MD5

43a8607dc3d7391e7abcbc494fd21f7f
SHA1

f6d028ac3ae30f0d6a336e697db9c3006ed932ef
SHA256

c401e66d2365e5c76ebdda225020827c92c5d54cd31703c56a2730c4e66a0b9a
SHA512

72853cbd50343250844e188e642eee87717882fa8801e6c35bcb58ab8f6c7eae2831773d97dabd5fc2c42dc9df339b8550829aaf4ffd9e2e6a5cd866a4c1fa7c
SSDEEP

384:MgAoh6spKdP+iWKEd7W+mmSEAkUOxJ046eRcercs7:7AxsAdP+xdi+vSnkjxJHOeQs7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2368	552	regsvr32.exe	95
PID 552 wrote to memory of 2368	552	regsvr32.exe	95
PID 552 wrote to memory of 2368	552	regsvr32.exe	95

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c401e66d2365e5c76ebdda225020827c92c5d54cd31703c56a2730c4e66a0b9a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c401e66d2365e5c76ebdda225020827c92c5d54cd31703c56a2730c4e66a0b9a.dll
  2⤵
  PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:3096