e0c875b2cb4762bb16896413eb5635615f7a98d68b3998491a0b4fa8da8f655f

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:10

Target

$PLUGINSDIR/VAProxyD.dll
Size

97KB
MD5

c3a7c71bce4ec04d63b7ef8ec9958c39
SHA1

cbe84ecbae1eb37557426783b7fa89a804d4fc09
SHA256

02a78e77cb64d9fa1f90ed2be6d9ff7b94624b2a790ed8109bfe61e66ebd825f
SHA512

9a5579cd5c437158d8277b64e583d18cd0113c186d1013e3c57c92d39a16b412ce9f95aef09dbbd05a36cab62e5193532c41eea6850b0a77d8502e7d1fa23468
SSDEEP

1536:2ublP85a1u5pJfGdw13FpZxRCH4zwpmW7RZO7VccUCdPJL8QaECL:2mU81UGd8RCYemWDSKCJZAD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2776	1636	regsvr32.exe	28
PID 1636 wrote to memory of 2776	1636	regsvr32.exe	28
PID 1636 wrote to memory of 2776	1636	regsvr32.exe	28
PID 1636 wrote to memory of 2776	1636	regsvr32.exe	28
PID 1636 wrote to memory of 2776	1636	regsvr32.exe	28
PID 1636 wrote to memory of 2776	1636	regsvr32.exe	28
PID 1636 wrote to memory of 2776	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VAProxyD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\VAProxyD.dll
  2⤵
  PID:2776