068d65dfda54a07ae2ee7973ac3e49ffe1d5367e741b29a8cd9b86dacb133be1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 22:53

Target

c1d0482b4e9036608ed5b1b74a77cbc2.dll
Size

72KB
MD5

c1d0482b4e9036608ed5b1b74a77cbc2
SHA1

ff1a44650fb20f0ce5871c797f9255f255dd76c9
SHA256

068d65dfda54a07ae2ee7973ac3e49ffe1d5367e741b29a8cd9b86dacb133be1
SHA512

9658dcfb3b49483d8dee87e35fbefe95d3f9e88e0b063b2a4dc3635ae9b15f071e45149c889cef3021617b3ed5c934c105d715e4350f5be670a2e1d87ae2eb35
SSDEEP

768:1rLl/zNqNWw0DAo1wdpkavNb6ahoICS4AIeqc06iRnbI/uNmwY1jdsEgLa1auRe9:PNjD1wEyAICS4A4c0DBgj2LaJc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3700	1580	regsvr32.exe	95
PID 1580 wrote to memory of 3700	1580	regsvr32.exe	95
PID 1580 wrote to memory of 3700	1580	regsvr32.exe	95

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c1d0482b4e9036608ed5b1b74a77cbc2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c1d0482b4e9036608ed5b1b74a77cbc2.dll
  2⤵
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:368