SUSPICIOUS — msedgeupdateres_as.dll

SUSPICIOUS — msedgeupdateres_as.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (67/100). 0 of 55 detection engines flagged it.

Identification

SHA-256: 0c9eb13e2bb547364572f7151e196a51537d124634b03145d6ae50b3a13d01b3
SHA-1: 3d6a87f1f921094816c614e954ad9d7a5427148c
MD5: dcd0c0a3ff86c36116f58bba21050249
imphash: 6c8408bb5d7d5a5b75b9314f94e68763
ssdeep: 384:HMgcVFXh71WmzIWNKnFUFw4sCi7mPuAsuUu3BUF/bql96u93RRSjJKlFIfNHF1V0:/m6Z452DuUu3+F/bE6uEJKIlHpK9z//
TLSH: T1F12D6FC97B2C5A42E339E0F81386C29E1399644B42BD37C9F82673978673217A61E54C
Submitted as: msedgeupdateres_as.dll
File type: pe · Size: 29528 bytes
Verdict: suspicious (67/100)

Detections (0 of 55 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 67/100 is the fusion of 2 weighted signals:

Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 5592) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 28 external host(s) at runtime (30 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

48 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787642674&P2=404&P3=2&P4=VzH57aeCVvAKSFV1SaHp%2fXResQ0j0HasoyhejF0Y%2b7dbUI3af6W%2bVnAwmn6YRjyujz4qdeKCnqPvJzQdQAdvHQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787642733&P2=404&P3=2&P4=NYrkyqj%2fuixD4NFPaNZjFLKTo2yPirX7K5hHEC%2bqr09%2fsewbK%2buJi4PC7aZbz9deXYwJKuz3KE8PX0987XaZHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787039411&P2=404&P3=2&P4=ENkRle9dltRO6pwKxlVwfeUjTzGnknD%2bhVTigQLvYeDblKZLPLvS4yMAjZH5l2KMmVoESMSxofr2zK%2f%2bAkVn%2bQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787038972&P2=404&P3=2&P4=M8qv1LiH11Tdq%2f5Afr9LyzvhPnBpWAdq1TMCnJVIxCpq6U7tskmw2ouD%2b%2bCvGNxjskskBbix8KckTx6mAe7jPg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.microsoft.com
crl.microsoft.com

Embedded IP addresses

203.26.79.13
52.123.252.233
4.207.44.69
52.123.252.220
52.230.60.54
4.230.171.124
172.215.188.232
74.179.77.204
20.165.94.54
20.42.73.30
52.168.117.170
20.231.239.246
52.123.129.14
52.123.128.14
135.232.92.34
172.178.240.161
92.223.78.30
52.148.114.188
52.110.12.38
162.159.142.9
52.110.12.8
72.153.5.63
4.209.250.170
13.69.109.131
40.79.167.9

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report