3add3f7f93d55414f5aa8fc7ad5d72cc7f991088436d8be1a9c7c3fa398b938f

Analysis

max time kernel
138s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 18:16

Target

AI_HibikiKoto_Voicebank/VOCALO Changer/ISSetup.dll
Size

1.6MB
MD5

bfbbfbe316b714c5564fb09561e84d60
SHA1

f7152b278d83cf305f6dc9e9b1ca80edc114ae3c
SHA256

1d2af11f057409ef8dfd452adad53c947121d4a9bade16bd3a3f2b407da10e2a
SHA512

1211d2c0b725cd63aea27074b35ba69d43f8287e624d45e10456ce41301a6073c5c36579ce23a0e24ce90bf3dad2707d428cc4dcd2a13d648d7a6c5e02af2313
SSDEEP

24576:eZi9ulj/qpNYDUBo8YeX5gdXFQb5Ays+Hbl/xIJ6dL1U7h:eWsj/qpWUBo8YQ5gt85Ays+R/40LW9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4644 wrote to memory of 2388	4644	regsvr32.exe	regsvr32.exe
PID 4644 wrote to memory of 2388	4644	regsvr32.exe	regsvr32.exe
PID 4644 wrote to memory of 2388	4644	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\AI_HibikiKoto_Voicebank\VOCALO Changer\ISSetup.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\AI_HibikiKoto_Voicebank\VOCALO Changer\ISSetup.dll"
2⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3656