57e90295056333b0de05689523eef17285d034a25a9a1965d789da54af854aee

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:17

Target
$SYSDIR/SkinCrafter3_vs2005.dll
Size 564KB
Sample240614-algtha1cpm
SHA256 5aaa62566d7daba371fbf221f0d93402b6560ef6032e23aeab55cacb1462c8eb
MD5 b5acb37197211dc215907499bc105745
SHA1 9f49f51cd716de78439617a10dd640b7f8f3a669
SHA512 bed50c385a3c1535a855720c616eb8540cf49a8f36793a43874416b0882f27ed4dbf11340ddb48308f9a0933d53add24e0392af53e692af6337ba951d9fa93f1
SSDEEP 12288:aNWqllnRg3Fo8e+xYFvqgMiMtF+YJ6ihCT34g:aNEFk50xvMT34g
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 5016	3192	regsvr32.exe	92
PID 3192 wrote to memory of 5016	3192	regsvr32.exe	92
PID 3192 wrote to memory of 5016	3192	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\SkinCrafter3_vs2005.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\SkinCrafter3_vs2005.dll
  2⤵
  PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:828