30242aaa99232db3e611481f2b3ed6f31b04f5d3111d0a8cc15e3531e80f81e2 | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 15:29

Sharing

Report Analysis Logs

General

Target

b7bec693921820d5c556c951fa7b0d6c.dll
Size

34KB
MD5

b7bec693921820d5c556c951fa7b0d6c
SHA1

8af2eee611b19218037abc80ef9b7283f0d447dc
SHA256

30242aaa99232db3e611481f2b3ed6f31b04f5d3111d0a8cc15e3531e80f81e2
SHA512

a5b485f8fbb2e871c1608dd0e713f944edd3556bdefd448ca18181a4c817321a3f62d715663a4a6b9bec06f765a6ba2a2819563c9618b09e6bdb60dd3c5df62d
SSDEEP

768:nQoi6qZO1Qegd2loF/V7zH0S2yDd2mLJ3+AF:nQv6qZ4Q3pT3H0Er+AF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4772	3872	regsvr32.exe	94
PID 3872 wrote to memory of 4772	3872	regsvr32.exe	94
PID 3872 wrote to memory of 4772	3872	regsvr32.exe	94

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7bec693921820d5c556c951fa7b0d6c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b7bec693921820d5c556c951fa7b0d6c.dll
  2⤵
  PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:3892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads