0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Analysis

max time kernel
160s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:54

Target
$PROGRAMFILES/Tencent/QZoneMusic/$_24_/QzoneMusic.dll
Size 383KB
Sample240601-p5e7cade87
SHA256 ea06d32ed8cf410337e1ad365beb828c96d7f9826cb4c3effc2f90fb08600aea
MD5 5a086fd55948ae0aaec0c69df88b4880
SHA1 48541cb68eb4387778fe7d23008a982f5879d0a2
SHA512 636be5d2a52d9d3fd88ed034a3169a27f3f75ba59284e78abc84ca258438f7ec5fa7d865ef7298f4a72b96f3db0592e7a0b567191fa0fc9a588e2c5e013c1e4a
SSDEEP 6144:BhMEktikTGmo68BcGzBZ70Qi9hDeEU50wDIV2CAcoQsCNGOgkAgh/v5XiWzNN:BuRiPcGH4Q4hDeUg8+WX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 448	4844	regsvr32.exe	91
PID 4844 wrote to memory of 448	4844	regsvr32.exe	91
PID 4844 wrote to memory of 448	4844	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Tencent\QZoneMusic\$_24_\QzoneMusic.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Tencent\QZoneMusic\$_24_\QzoneMusic.dll
  2⤵
  PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2720