32b4bc7fefad278dca61055c972b0f2e0e2a7f3a25e087b85e38c895f1e7fd5c

Analysis

max time kernel
130s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:15

Target

WebKit.dll
Size

6.7MB
MD5

f7cd4c3e8eb817ea08ebd7b26f6be9e5
SHA1

6131a33239e3e49bf8a65ed15e1f9096cd19d7f5
SHA256

460100090d12c0d79016f56229b807c0623db39ee0944e1c7e8cb0afc05ce70d
SHA512

62c6bee96fc042d9de359f4662e1e15a368ddd7c2399936899adfdf35c86181475a1c14152d3484bea02323d7906b12eac3b2425d437dd8443e6585c8ff258c0
SSDEEP

49152:KZrVn/pbln488GsG2pu+/U7dd55XMzsw39Qm7D8scc1YYvUpjJNhCSIe4AIT2FKG:0p/J8vuD7ZGCmjcc2aIjJNtQtIKG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3972	1548	regsvr32.exe	87
PID 1548 wrote to memory of 3972	1548	regsvr32.exe	87
PID 1548 wrote to memory of 3972	1548	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\WebKit.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\WebKit.dll
  2⤵
  PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4952

memory/3972-0-0x0000000001360000-0x0000000001370000-memory.dmp

Filesize
64KB

Download
memory/3972-1-0x0000000002C60000-0x0000000002D92000-memory.dmp

Filesize
1.2MB

Download