826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 21:31

Target

826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d.dll
Size

132KB
MD5

4e6ea28888962a0876dfb9df6531bfb5
SHA1

ef5126bbe9a39749c99f79ff32d28912da92e1ef
SHA256

826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d
SHA512

67ff4b668a61d13c3f7f1c835e03475beaa18612a8d9962ad8506fed2ea9c4fc38295447cc3e1e47c8d77d104e2c48b9b1c4b94f297fd5ca08842092565a84bb
SSDEEP

1536:7S+SH1oEpAzfChxmIfWOKMkcgHZZIkUh0IPXloI5u/+N+qsUeZR162tAVvfaK:vEeboYc6I5umN+qsUeZR162tAVr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3088	2528	regsvr32.exe	95
PID 2528 wrote to memory of 3088	2528	regsvr32.exe	95
PID 2528 wrote to memory of 3088	2528	regsvr32.exe	95

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d.dll
  2⤵
  PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:3744