e791985263b2df4b00652a69f4d6ac925dd2e7a069b9cc30ccb6fc5c813ec44b

Analysis

max time kernel
118s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 03:10

Target

$PROGRAMFILES/alot/bin/alot.dll
Size

798KB
MD5

0cbd99c9d64cbd7b5b6d7c67e4a9ebbd
SHA1

13b7dcaed28e19d550bbba32c28b159d8f834919
SHA256

ff66e7729cc28bdb8519424cb1fb6e0aff3bf168cd50228a00eb9c5139179677
SHA512

a2966555b17d21a80dbb287b896a1895cab5184d157c0d15ea41436f43b2946b25b6d25a6fa82639f219b92c8a54b6e88c419d083fdcfef7b4ae8c8f5c5ad917
SSDEEP

24576:Ey2rOWUTByKJY9WubS68+yBXN0nhCbVGEXLA1mAauxAbSEmPY:8p3HSZBXWMXLA1m+EGY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 2064	3256	regsvr32.exe	94
PID 3256 wrote to memory of 2064	3256	regsvr32.exe	94
PID 3256 wrote to memory of 2064	3256	regsvr32.exe	94

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alot\bin\alot.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alot\bin\alot.dll
  2⤵
  PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:8
1⤵
PID:2112