cbe5cdf7ad6e2c7b436b15be3f500205a5d62d9fe07f7744171a19e1486a176f | Triage

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:19

Sharing

Report Analysis Logs

General

Target

comdlg32.dll
Size

137KB
MD5

b73809a916e6d7c1ae56f182a2e8f7e2
SHA1

34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
SHA256

64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
SHA512

26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
SSDEEP

3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2156	2092	regsvr32.exe	28
PID 2092 wrote to memory of 2156	2092	regsvr32.exe	28
PID 2092 wrote to memory of 2156	2092	regsvr32.exe	28
PID 2092 wrote to memory of 2156	2092	regsvr32.exe	28
PID 2092 wrote to memory of 2156	2092	regsvr32.exe	28
PID 2092 wrote to memory of 2156	2092	regsvr32.exe	28
PID 2092 wrote to memory of 2156	2092	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\comdlg32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\comdlg32.dll
  2⤵
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads