20c011abb545a90c2e1574ea59931491104c4ac9b73177fe958fd98973d9078c

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 17:43

Target

$SYSDIR/$SYSDIR/atl.dll
Size

88KB
MD5

8767eed69af09e16ebd375e22f0b62c2
SHA1

07a3cf996a552f9d4894a90e56ae6c9bd1688b9b
SHA256

ddcd10caa5a980e44c37e42a65d00dbc9595137268230a2c29764ac16658fac8
SHA512

8c9f9a2242a07f3967dc9a2f012d7301e66db991efce0a206c42eed07930c8d5e79d3f5cced9c03719ca94148dcd564818ce5156f65da5886e2c2d1279653406
SSDEEP

1536:bDMtOPBm/dd6giHvwJZyEbWMIOLQcL/X/xhG6QKZwmNXcTUukXP:bvEdMIJZyEzL3LP/xI0ZwmHukXP

Score

1^/10

Modifies registry class 1 IoCs

Processes:

regsvr32.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATL.Registrar\ = "Registrar Class" regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATL.Registrar\ = "Registrar Class"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4156 wrote to memory of 452	4156	regsvr32.exe	regsvr32.exe
PID 4156 wrote to memory of 452	4156	regsvr32.exe	regsvr32.exe
PID 4156 wrote to memory of 452	4156	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\atl.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\atl.dll
  2⤵
  - Modifies registry class
  PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4488