d81fdcc0520f1f01645e978ae21fcd7e01887044249d7ee1d0e018a6832320a5 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

comdlg32.dll
Size

235KB
MD5

41c157ba2f205017ec26998009ccb046
SHA1

e45cb2881dc870f5f7686f3e75190acccb3fad68
SHA256

f95a15065e51d643836cf90714b21e00cef2db2f1b2da73618fe2141b57f728b
SHA512

2729eb4cf571196b5a722e3c287ca6191ec2fc2e7376a8fc59c662bed69ca9742784382fbf800f31654058c99827493b92799be09dc7d98515a9cddbe010b38c
SSDEEP

6144:pZKhLyWBR4ss1HFRUeq1AUL0DvBic6BL2b/HBne:3KFPyweq1JCvv6h2R

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2404	1956	rundll32.exe	30
PID 1956 wrote to memory of 2404	1956	rundll32.exe	30
PID 1956 wrote to memory of 2404	1956	rundll32.exe	30
PID 1956 wrote to memory of 2404	1956	rundll32.exe	30
PID 1956 wrote to memory of 2404	1956	rundll32.exe	30
PID 1956 wrote to memory of 2404	1956	rundll32.exe	30
PID 1956 wrote to memory of 2404	1956	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\comdlg32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\comdlg32.dll,#1
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads