5c8c5985ccadf49c31db958ab37bf9364bd9275501dd186c60eb62a5fee4b34b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 06:23

Target
comdlg32.dll
Size 137KB
Sample240113-g5stfaebc6
SHA256 64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
MD5 b73809a916e6d7c1ae56f182a2e8f7e2
SHA1 34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
SHA512 26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
SSDEEP 3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2180	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2180	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2180	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2180	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2180	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2180	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2180	2076	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\comdlg32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\comdlg32.dll
  2⤵
  PID:2180