0e563364aa5e690f1241f05eeed1718e1514aed3b32062e3be9b7dcc82c378bd

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:07

Target

55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4.dll
Size

132KB
MD5

ba33bff302fdecf939ed96296d93593f
SHA1

f422c218c50549a380234e6c57231e95a5774371
SHA256

55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4
SHA512

3ca1e38a95818811f15aedd86bd202e4e698600e3a9143c338b4908ca8b5890f9f7a81f75df7f4337b1331de4e49428dd17d996bd21691e600385f67afcaabbf
SSDEEP

3072:W3sOOO1kCH3gxtJC8UDqYfGbKDkvKjxCy:W3sOl1kqOC8U/6Ikyjx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3172 wrote to memory of 1108	3172	regsvr32.exe	regsvr32.exe
PID 3172 wrote to memory of 1108	3172	regsvr32.exe	regsvr32.exe
PID 3172 wrote to memory of 1108	3172	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4.dll
2⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
1⤵
PID:3060