09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85

Analysis

max time kernel
589s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 09:35

Target

AppUtil.dll
Size

1.5MB
MD5

7e489e7300d3177f64db31665a2079e0
SHA1

50b20f0b4e5bb5b35e68dd90a5c465dffd30260e
SHA256

7a426359908ae2b6ca1bc8a2773269a48126c2db23c171bc56a3456da4f0016c
SHA512

0b3b34c0e5e095dfd77d801cd7e85e0431da23bf1c943aacb855a40f5a0d9439d7667718abe654eac17ed474b3c9eb644b90cc8cc215c9adc99b12e29b7907d3
SSDEEP

24576:gbp2vEtmbb6kMjihOgysnGc7EiHhP2C1oPObTSFXhPq2QWv/Ec+M6em:gbpLtmbe7dSvAObTAXhPq2QW3Ec+M6em

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2700	1480	regsvr32.exe	95
PID 1480 wrote to memory of 2700	1480	regsvr32.exe	95
PID 1480 wrote to memory of 2700	1480	regsvr32.exe	95

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
  2⤵
  PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5064,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
1⤵
PID:3484