e72826c3dbd6781eaa34b9ec33e276f6d811c36c3a6ced9ae95e67fbf1c7cf8c

Analysis

max time kernel
92s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 17:35

Target

wjpjk/Support/COMDLG32.dll
Size

140KB
MD5

9f804f674fc005ff407b6b13847e0625
SHA1

1e5fe473c01812141bb1e943ccd54887158beca8
SHA256

f344486cd53d96dd21214611eb2e03ca0963c532ea6bff0d9c7bf9dc20270b06
SHA512

73e488c80a40afab4202dfe0e76e4361434106ef564e5e8173f3205ecca11c17dfe787876644df8a643a0659359aa54d6a07d7eab2bcbf28f6618d6c8f108e1d
SSDEEP

3072:HESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzXS0:HETz566VgRyOJ0oDxQRHf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4740	4464	regsvr32.exe	83
PID 4464 wrote to memory of 4740	4464	regsvr32.exe	83
PID 4464 wrote to memory of 4740	4464	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wjpjk\Support\COMDLG32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\wjpjk\Support\COMDLG32.dll
  2⤵
  PID:4740

memory/4740-0-0x00000000217A0000-0x00000000217C8000-memory.dmp

Filesize
160KB

Download