f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 03:39

Target

f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
Size

1.6MB
MD5

e180df04028e8fdf3d6db4a766291751
SHA1

1b94e85065365d4b97b37bfecbad152a42d7f653
SHA256

f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718
SHA512

87cb27683131174eea48e8175d4bb105b28cbdeedeaa6b56bdbd19d71b19e0d7a987b7a85cb56ddda7e725e877afcad39605ba25a03d8762f17ccdef06b72173
SSDEEP

49152:YK8OhN1igMM94bX4N2wTA46hcjB/CrCHG:YeEb88AjhCSG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4892	2220	regsvr32.exe	90
PID 2220 wrote to memory of 4892	2220	regsvr32.exe	90
PID 2220 wrote to memory of 4892	2220	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
  2⤵
  PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4584

memory/4892-0-0x0000000002D70000-0x0000000002DCE000-memory.dmp

Filesize
376KB

Download
memory/4892-1-0x0000000002D70000-0x0000000002DCE000-memory.dmp

Filesize
376KB

Download