d81fdcc0520f1f01645e978ae21fcd7e01887044249d7ee1d0e018a6832320a5 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 19:00

Sharing

Report Analysis Logs

General

Target

comdlg32.dll
Size

235KB
MD5

41c157ba2f205017ec26998009ccb046
SHA1

e45cb2881dc870f5f7686f3e75190acccb3fad68
SHA256

f95a15065e51d643836cf90714b21e00cef2db2f1b2da73618fe2141b57f728b
SHA512

2729eb4cf571196b5a722e3c287ca6191ec2fc2e7376a8fc59c662bed69ca9742784382fbf800f31654058c99827493b92799be09dc7d98515a9cddbe010b38c
SSDEEP

6144:pZKhLyWBR4ss1HFRUeq1AUL0DvBic6BL2b/HBne:3KFPyweq1JCvv6h2R

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4020	1908	rundll32.exe	83
PID 1908 wrote to memory of 4020	1908	rundll32.exe	83
PID 1908 wrote to memory of 4020	1908	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\comdlg32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\comdlg32.dll,#1
  2⤵
  PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4020-0-0x0000000000C10000-0x0000000000C4E000-memory.dmp

Filesize
248KB

Download