4ab7ec2cacab3d5f5debf66062959900c0a7c6dbc341e8fd2730f5bd3f345bc1 | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 10:03

Sharing

Report Analysis Logs

General

Target

$SYSDIR/msjet35.dll
Size

1.0MB
MD5

2bcb3e39703a69b0235ad937c0e4b1ac
SHA1

8a3a66c533f3e9361f698f280423dad4bfa7431b
SHA256

91dc7e10f4f97c0046b4b91b04b5195b95f3f0fd36260fa6433ef2ef623cb0dc
SHA512

500574ed6231d2354165052de53383190c7c187399991d3fb1ccb95709dc8cb795f4a9241d6da4f68f66ada5f1adc782786e6f2fd2a7a46252d0f9c599cefc03
SSDEEP

24576:mTZtL5tRvRV0sjN+YBMxd/r3oc90orxuD6AmuqbdRM+92b:6LvHAYmxdj3codNAmnb/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 1840	4420	regsvr32.exe	88
PID 4420 wrote to memory of 1840	4420	regsvr32.exe	88
PID 4420 wrote to memory of 1840	4420	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msjet35.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msjet35.dll
  2⤵
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads