08371868aba92e7e40b8c2b7684ae051d846f288ab5692eb79b4ee19c7f9a4f8 | Triage

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 11:42

Sharing

Report Analysis Logs

General

Target

Comdlg32.dll
Size

149KB
MD5

ab412429f1e5fb9708a8cdea07479099
SHA1

eb49323be4384a0e7e36053f186b305636e82887
SHA256

e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240
SHA512

f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9
SSDEEP

3072:VCslb9HnH/GrQ/qCFyn7dWXSQeRDBIY/OR5JrNo2CocrJbNN6N2TRqEydc:VCsB9Hu9nweRD4JZoDxtRHj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4884	5112	regsvr32.exe	91
PID 5112 wrote to memory of 4884	5112	regsvr32.exe	91
PID 5112 wrote to memory of 4884	5112	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Comdlg32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Comdlg32.dll
  2⤵
  PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads