a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 06:44

Target
$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
Size 40KB
Sample240531-hhlbhsbb66
SHA256 1bf2270bfa6bafe29329f9d84c5f8856b57c84af6f3ed05027cebc4f767d07ef
MD5 b59ec4aa8cc4eeb16e5567c085d5d677
SHA1 7c2442b35816e0517648a390f106910ae960f7bf
SHA512 719d127a378fb16772c5a6c4b6ea6225a27ad4cd2a0d84e237faaa7a1a4e63cdd869ad2cf04b57268e393f709adea2a8aa83c6a640111d93fd2071ebdac7a470
SSDEEP 768:MzE7orC6TyNqZ7t7Ahh5E4C6FHYm6d985dgn49kjkGnUOhBpEdpb:tkTym7t7Ahh93+dqgbjXUOhBpeb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFC41FD-50BA-43d2-9ACD-6A2A874D2853}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$TEMP\\mode\\Thumbs.db\\intern\\ActiveSyncBootstrap.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFC41FD-50BA-43d2-9ACD-6A2A874D2853}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFC41FD-50BA-43d2-9ACD-6A2A874D2853}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFC41FD-50BA-43d2-9ACD-6A2A874D2853}\ = "VSD ActiveSync Bootstrap"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFC41FD-50BA-43d2-9ACD-6A2A874D2853}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 636	1972	regsvr32.exe	91
PID 1972 wrote to memory of 636	1972	regsvr32.exe	91
PID 1972 wrote to memory of 636	1972	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\mode\Thumbs.db\intern\ActiveSyncBootstrap.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$TEMP\mode\Thumbs.db\intern\ActiveSyncBootstrap.dll
  2⤵
  - Modifies registry class
  PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:904