b205d934150c3148b352e89367e4ef899822454d9a54cc57602b54c26bda7278 | Triage

Analysis

max time kernel
85s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2023, 19:46

Sharing

Report Analysis Logs

General

Target

New Soft/msсomctll.dll
Size

1.0MB
MD5

d268668751ee22997d7ef1417034cb04
SHA1

d8a87438ab0df47fe252b06162a986399cafffe1
SHA256

fac6736251d3c61ecbd63be0420d1c75d5cd0442181d479013330155ca37d358
SHA512

75f40cc8c92e3fcdd381669f6aa0bf1e76ee6fec0c5cbf53ea0bbfbff199ac7229fc1405f737420badd24f438b49b8d2eed2bb0f3fad0bf8a974f54bd6964a34
SSDEEP

24576:TcqSrNXsCxx927qRC33KjjnZRqPnFqRo7w3zgyZdt+:TCXjx/2G9cv77EnM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2468	2456	regsvr32.exe	75
PID 2456 wrote to memory of 2468	2456	regsvr32.exe	75
PID 2456 wrote to memory of 2468	2456	regsvr32.exe	75

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\New Soft\msсomctll.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\New Soft\msсomctll.dll"
  2⤵
  PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads