bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e

Resubmissions

02-02-2024 14:59

02-02-2024 14:53

max time kernel
580s
max time network
571s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 14:59

Target

ikernel.dll
Size

676KB
MD5

f7217ffc0aac4e60dc9f1c0d687c20b3
SHA1

c04fa2ab93aaf44a824364cfd4b2c03a9bdb1f38
SHA256

8b44a220ec6760a728d2fc7c1a31c39550c5c991d8decd1cd56e7d9c18f12135
SHA512

ab954477f04319b5c14a5d4dd09f964dc2dddf1dcf1222fd7e32b39d02f40004f53296ef05484b1bce995035f4626acdcb8632eebed40b11c2b5e679e21842d1
SSDEEP

12288:nObIUZvGz/DrG2wfIyorSWhUDgxhswHABw/C/GO/5e02sUh9hAtEd7C91Lmiy:nOcw6/+Porvh/hswHcw/C/thpNUNAtO1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1568 wrote to memory of 2668	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 2668	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 2668	1568	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ikernel.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ikernel.dll
2⤵
PID:2668