0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 18:36

Target

0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc.dll
Size

85KB
MD5

cfb49503a814ce8c46486d101ca1d4f2
SHA1

960bb0b36285b73ee8f97884e0d776639b56a330
SHA256

0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc
SHA512

bd9ddb2f4d16b1f38e34c5834caac67ddce91dd37bc274c9e5a02f147129b16b26a99d515097508934ef4736dccc39cabf3a17bc6bb114a6ef4b6d9da4e87c24
SSDEEP

1536:YtlUExzFTF4hk7LlNkn1TxGhAzfyjBfQ9StxjuKjjRzS1l7y:Az+kVMTRzuxjjjjRzIl7y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3988	4628	regsvr32.exe	88
PID 4628 wrote to memory of 3988	4628	regsvr32.exe	88
PID 4628 wrote to memory of 3988	4628	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc.dll
  2⤵
  PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1280,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:2112