e77bb76dff41572ccb358aabe331ea4ca0e5a55d9312aedaf6080b4570d00a49 | Triage

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:41

Sharing

Report Analysis Logs

General

Target

eventcls.dll
Size

15KB
MD5

21cb81e67facace4697047010706924b
SHA1

77d34d7211493f3be3f8126a254298a112b48694
SHA256

e77bb76dff41572ccb358aabe331ea4ca0e5a55d9312aedaf6080b4570d00a49
SHA512

c960e47031d34a30f242a1966fecf9f576af2681856510a9b65a2689c557c80a3dc9225215ba689918ed46f056df50350008f6073b615e8fa76e6ddaf9cb11dd
SSDEEP

192:TkrfQVbS34v0Ja++I6sgxA7uhjhXkEucycWqUpWnpBlc:T7Si0Ja++I6sg11hX5ycWqUpWDlc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4280	4344	regsvr32.exe	90
PID 4344 wrote to memory of 4280	4344	regsvr32.exe	90
PID 4344 wrote to memory of 4280	4344	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eventcls.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\eventcls.dll
  2⤵
  PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3940,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
1⤵
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads