4cdb5a1fbe2b961c6ee7aa63411a44eee1d86671053ba877c2a5d4e3fcb673eb

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 01:56

Target

workwinScreen//MSCOMCTL.dll
Size

1.0MB
MD5

ecc7d7f0d3446de36045d1d9e964fafe
SHA1

da6b0ec081d628c33b150327f3bd16d3b7fa4729
SHA256

bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
SHA512

443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
SSDEEP

24576:s0LiK1d6dxOehwsj5dC33M/jYVRDSfaF0gg1CVGO7oVtNKG:n6dAehwaY19G1u7+Ln

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2768	2392	regsvr32.exe	89
PID 2392 wrote to memory of 2768	2392	regsvr32.exe	89
PID 2392 wrote to memory of 2768	2392	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\workwinScreen\\MSCOMCTL.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\workwinScreen\\MSCOMCTL.dll
  2⤵
  PID:2768