bfb2516cb2678b6b5a398d655cbacb124363e0bb59bd4d3dfb29984747523639

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 02:14

Target

ca38afba9cca65c9042ea971daea3552.dll
Size

33KB
MD5

ca38afba9cca65c9042ea971daea3552
SHA1

96d1c77001bb41ae41bbc3f6b2efb1f3a161ae6b
SHA256

bfb2516cb2678b6b5a398d655cbacb124363e0bb59bd4d3dfb29984747523639
SHA512

3c4f570d200a8c3e4924a1183f6586f9223dbb4b1c61ea2a67498c70efdcd718e769dfb278812e16fdb89f3acb663d20e2d4ef7889e91178ba5db1509e4cc335
SSDEEP

384:Id+k6d9hNxrtDZ4Ku+J7741Wlhx6IFuw1bFNqZtpAFyuLgaX85dTdM98lIH6LqK:S+v9hZT7MimIFpFwAXlXcjNlw6x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3812	5004	regsvr32.exe	93
PID 5004 wrote to memory of 3812	5004	regsvr32.exe	93
PID 5004 wrote to memory of 3812	5004	regsvr32.exe	93

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca38afba9cca65c9042ea971daea3552.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ca38afba9cca65c9042ea971daea3552.dll
  2⤵
  PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2248