7f4af8bf6568d684df93719bb2c64588ac3117885f07bdb7c46ce1d981a71013 | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 01:14

Sharing

Report Analysis Logs

General

Target

MSJET35.dll
Size

1021KB
MD5

9f6faf209bec2362523a0e9509f78964
SHA1

4de5040079af1ca2a0e797266bed406d466d171f
SHA256

4a8fac0d6b09cc3fb57fd063af8b1a332080df5b0e2ff3710a82c109a4eee07c
SHA512

d3465bf62f81cbb3e4251b602983d0500b191c6a9786e925966b4eb70d7e5329401cfd47684838c3a0c338ccc08e1995f965406ae4c0a4a236c8df5b6e0d4ebd
SSDEEP

24576:xjU5HkJo/yEuBNNk+fUI4RDH5fM55AbT9woC9E6uNuIe:2oPNNkWVyDH6Ef9woCK62

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2104	2480	regsvr32.exe	28
PID 2480 wrote to memory of 2104	2480	regsvr32.exe	28
PID 2480 wrote to memory of 2104	2480	regsvr32.exe	28
PID 2480 wrote to memory of 2104	2480	regsvr32.exe	28
PID 2480 wrote to memory of 2104	2480	regsvr32.exe	28
PID 2480 wrote to memory of 2104	2480	regsvr32.exe	28
PID 2480 wrote to memory of 2104	2480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MSJET35.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MSJET35.dll
  2⤵
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads