224da404f85b1f4ea2e95ac0c2d403fa70135ce9ff22246889bababca20241da | Triage

Analysis

max time kernel
1384s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 13:17

Sharing

Report Analysis Logs

General

Target

MSVCRTExt.dll
Size

1.0MB
MD5

7aa124480e548155d65bae921f391afa
SHA1

23ac725e5a63995d0e27a5841c969486e1d2c3f5
SHA256

224da404f85b1f4ea2e95ac0c2d403fa70135ce9ff22246889bababca20241da
SHA512

7d02132340b35551a474e55c4e5e5e7f0839a1294b017abf0e2c6d7fd45e8d2235608c2bf4233e7e6957155a932c9f1f8a14dd1c36bd567a1c66861586b8a363
SSDEEP

24576:05nJIDlyEgORmiRly2oQ9dMGpuFU6DfCq1:05+cQFAgdRgFUGfCq1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1576	848	regsvr32.exe	83
PID 848 wrote to memory of 1576	848	regsvr32.exe	83
PID 848 wrote to memory of 1576	848	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MSVCRTExt.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MSVCRTExt.dll
  2⤵
  PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads