c4079adbd900f429976e7363d635dca803e7d244675263ebb30b1ea8fc889e29 | Triage

Analysis

max time kernel
138s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 23:30

Sharing

Report Analysis Logs

General

Target

PublicModulePlusin.dll
Size

2.5MB
MD5

ac5b798479b163e732574ff442001559
SHA1

570ba95fd366ba902b935bd12d0c74d954ca377e
SHA256

1430b1e59ec9c9647964618306105c7a040f9f9e1ceb9f22b255843dedbba695
SHA512

4d69e38d9481fca84f00a75c3514209bb4f2eee68acbd77340c4909b04f885f8a03b67823765ced863fdc34e8a0d624c16631ff7acf20e77a7107e35113b8d91
SSDEEP

49152:R76zFMWgFFS0OfWtz8LQ4/1kYrLALX+2/aQ:RGzF9gbOfWtm1rLALO2L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4104	4184	regsvr32.exe	91
PID 4184 wrote to memory of 4104	4184	regsvr32.exe	91
PID 4184 wrote to memory of 4104	4184	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PublicModulePlusin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\PublicModulePlusin.dll
  2⤵
  PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3824 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:3464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads