1743c09774c8aa85ea6463bf48def681e4ccf13660620e7378ecd9df6c33169b | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 16:37

Sharing

Report Analysis Logs

General

Target

Fish-v327-0221/mfc42.dll
Size

1.1MB
MD5

74c76bb54b26ce50c4bc755f92687c63
SHA1

3c13dacdea9b588477b76c395e2223185e064308
SHA256

7dd3d4a6898f5c0fc3b6bbeb1556f48cc4f7e599d9b63f5f04231b3ca8a7922a
SHA512

90103fa6fdae3b871057e2764ae9b9dcbda556d11088b378e23a97775946cd7e8bb16171b558e8d475f0c5aa4dad5969b0e1146759449824e628dda7eae6135f
SSDEEP

24576:TuerM6WEuv3OZEB05Bp8NhVjJBHbtbajNzbcpsa9G4b1Tm:LrM6WEuvtB0+9jjHbCcPb1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4848	2464	regsvr32.exe	89
PID 2464 wrote to memory of 4848	2464	regsvr32.exe	89
PID 2464 wrote to memory of 4848	2464	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\mfc42.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\mfc42.dll
  2⤵
  PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads