0187a11496437b76b2401bc6136432547b6bcdaca30f2b7d16e4d39f47d5c3ee | Triage

Analysis

max time kernel
90s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 08:05

Sharing

Report Analysis Logs

General

Target

PS/comserv.dll
Size

2KB
MD5

6d54b4f07a1b92bd6fafe7160b2c887c
SHA1

6bf4a36e729a2c4156b1280db97252ba8ea7d9b4
SHA256

653fe0ab7b634e50ba09f962c6357bcf76ce633768aa41dd01d1a93ef83a0a54
SHA512

32c57ca7ce437fc7712948a6f30733112830ff570d89ca903e5a5bdec43277a19a453df8c027e0835ad1dff2f7927cf973e33efa1847ed608cb6eb534d8163a3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1576 wrote to memory of 3040	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 3040	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 3040	1576	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads