cdd9213c986f4dcc1f2c07f584d564c6a3ba00c9c27fe016bf51fd70ff0ef973 | Triage

Resubmissions

28-03-2024 13:35

240328-qvvdysfd4s 4

21-03-2024 15:21

240321-srcqvaed68 10

Analysis

max time kernel
159s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 15:21

Sharing

Report Analysis Logs

General

Target

AppUtil.dll
Size

1.5MB
MD5

3f232fd34abbba86180fd6b5e02f99f0
SHA1

65475e6d32bd40bc1347ed206f9d33442ba41c2b
SHA256

552dd772b479d9f7f8f27712a0f2f8daf8cb501d90acc1468e0257bde2bffca8
SHA512

0c4086dfe128dedfa7d34958e15f993108cf6b7b49ed82d3e4e889b1ade3d8c7ff0a167616a429c50dd69c9cb12ec81ac6e69c25c2f8907163be1039514b913c
SSDEEP

24576:B8VkPNZLUJzoKeECO/He8wekOHklDRLulTScsVPvL2Mu4SVtIH+1v9:BPUJqSUulTtsVPvaMBSVtIH+1v9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1456	5004	regsvr32.exe	90
PID 5004 wrote to memory of 1456	5004	regsvr32.exe	90
PID 5004 wrote to memory of 1456	5004	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
  2⤵
  PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads