8a67ddc6e0166cb54eace3c5ca68b75f787d7fea5498310cb7589d7b59e83fd2

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 13:33

Target

8a67ddc6e0166cb54eace3c5ca68b75f787d7fea5498310cb7589d7b59e83fd2.dll
Size

766KB
MD5

3606c110fa82c40639a3dc6eaffe3dc3
SHA1

379660e6a849317c8c8ee70e4a30d4dd4b64c86e
SHA256

8a67ddc6e0166cb54eace3c5ca68b75f787d7fea5498310cb7589d7b59e83fd2
SHA512

8f5305727529773030ccc58051afc5bd08542733d074b86ef5b1bd51d3998e2b4551df71cea507cc8efdacb07e0807a575f7ef131385b99ac8ccf4845d599f9d
SSDEEP

12288:qA/UFYdaEIapNgOiIZSaffJ+ic0+Sx3HPSFZ0MUWuFeymI+tscW7JC:qA/UE/IapNgOioSaHJ+lhufSFZNUIIWp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4912	1172	regsvr32.exe	96
PID 1172 wrote to memory of 4912	1172	regsvr32.exe	96
PID 1172 wrote to memory of 4912	1172	regsvr32.exe	96

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8a67ddc6e0166cb54eace3c5ca68b75f787d7fea5498310cb7589d7b59e83fd2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8a67ddc6e0166cb54eace3c5ca68b75f787d7fea5498310cb7589d7b59e83fd2.dll
  2⤵
  PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4880