SUSPICIOUS — msedgeupdateres_hr.dll

SUSPICIOUS — msedgeupdateres_hr.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (67/100). 0 of 55 detection engines flagged it.

Identification

SHA-256: 59d85cf2fef5d3082e3a25f8147e107b1e03c3f4b83284b63b65f6cdb5b0bbad
SHA-1: c240b8fbabf6ba8dbb4a7c4f80ca5a0c65c7cb0b
MD5: 6b7c905fea0e330d822baee114182387
imphash: 6c8408bb5d7d5a5b75b9314f94e68763
ssdeep: 384:6ikVFXh71WmzIWT/fbmrsCCa9gNk8qaEa/+IHlNgPdrj/R9zq+L4f4yl:OHzqJva/mrjZ9zJyl
TLSH: T1D02E3CDE372D2741D266E5381641E2FC1AADB0D152B8329C6E5647B38172023FC399BE
Submitted as: msedgeupdateres_hr.dll
File type: pe · Size: 30040 bytes
Verdict: suspicious (67/100)

Detections (0 of 55 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 67/100 is the fusion of 2 weighted signals:

Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7856) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 25 external host(s) at runtime (30 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

48 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787637388&P2=404&P3=2&P4=AwEokINjmhf%2bqeLyGFGQq73PnbkFlb4702kNle5%2b%2b45RKkEKkLaMsftqaClW7ie3ChgzXPyt6Zh8uEMSdOyUEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787637456&P2=404&P3=2&P4=EPoJfr8nm6GkIEudXsbU8BfDj7AaMHBPvKwtvsKAR0LRkKCdxur9%2bHGY0yPLO2PivksGA9rgr5zafXzCo2sg5Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787034102&P2=404&P3=2&P4=R5q%2buej%2bMHy4LKtRYVK9HLnXccrGEmsDi%2b8xKSAe5%2fDuYcO2Ev%2fLh2K1VCQ%2fpaDjyDh3TZaV8jYvQeDa3nRwzQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787033732&P2=404&P3=2&P4=MlR2c8z6LIZ1UkGApz5PnLTVjxhVr9%2fTipVQ2OMneZlhpvBCFGIOTfyURziRH3ZAS4RX65l%2bGGhSjVoI2wJ0eg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.microsoft.com
crl.microsoft.com

Embedded IP addresses

13.69.239.69
52.230.60.54
4.230.171.124
85.210.196.11
74.178.240.61
4.150.223.98
74.178.240.51
52.123.129.14
20.76.201.171
40.99.133.242
52.168.117.168
74.178.232.29
203.26.79.13
135.234.160.245
172.215.188.225
52.148.114.188
51.105.71.136
52.123.252.243
72.154.7.99
172.170.180.133
4.150.223.109
92.223.78.30
142.250.195.131
52.110.12.21
52.110.12.42

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report