331beee62615c661c062235d993f58d54c1602d40b2cde0014166588fd36b2fa | Triage

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 11:55

Sharing

Report Analysis Logs

General

Target

amstream.dll
Size

78KB
MD5

ced0d3906799750a58b1fea7f0149425
SHA1

f9dd12bb310c137e4d7dd6afd8be23554829ed68
SHA256

331beee62615c661c062235d993f58d54c1602d40b2cde0014166588fd36b2fa
SHA512

1cade3a0cdda4bba4c6f3e9825665d580099edd355b44a94cd342d06bf1e3653c9b21b35375253c0310f4b7261eb7a7271d12952d793dee7712e204a37d7873e
SSDEEP

1536:/7ndxLQY8/6sF3GNnM/EqyV1QxyhkXUPcy/eBgTR96ieC:/RxLq/622N0JycyJPcETSieC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2548	2772	regsvr32.exe	91
PID 2772 wrote to memory of 2548	2772	regsvr32.exe	91
PID 2772 wrote to memory of 2548	2772	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\amstream.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\amstream.dll
  2⤵
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads