d7d47aa5796cad499374b284e865f715e7496efca16566add1c3a505730259de | Triage

Analysis

max time kernel
133s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 06:48

Sharing

Report Analysis Logs

General

Target

kisupco.dll
Size

313KB
MD5

98fc1aad0bbfb1905eaace38830c4833
SHA1

530c78e4a6b6658502813f91fd981a1c094c08eb
SHA256

df8916c996286c59475b93e50c6471236b12d8a64f2f079d773b8b5224fe0aa7
SHA512

170472986a405a412b527a34643d52f984f76bc3ccb6feb732a2943bf26743be2e35805bae26d00858a2ce1c9e302c9b679ec2b92309ab4d043212d1cf1f8797
SSDEEP

6144:nYL+rabxjGEL7zvrAfzZ+bV5HEZFx97vCzMels:nYLUsGELHvrkzZ+x5kZFxpgls

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1344	3524	regsvr32.exe	91
PID 3524 wrote to memory of 1344	3524	regsvr32.exe	91
PID 3524 wrote to memory of 1344	3524	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kisupco.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kisupco.dll
  2⤵
  PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3048,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:8
1⤵
PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads