16a6baf82a2fb1c366cc6f94c382d55172e72855a5e435c898c6429aab2edd3c

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 23:58

Target

$COMMONFILES/PPLiveNetwork/kernel/VAProxyD.dll
Size

97KB
MD5

c3a7c71bce4ec04d63b7ef8ec9958c39
SHA1

cbe84ecbae1eb37557426783b7fa89a804d4fc09
SHA256

02a78e77cb64d9fa1f90ed2be6d9ff7b94624b2a790ed8109bfe61e66ebd825f
SHA512

9a5579cd5c437158d8277b64e583d18cd0113c186d1013e3c57c92d39a16b412ce9f95aef09dbbd05a36cab62e5193532c41eea6850b0a77d8502e7d1fa23468
SSDEEP

1536:2ublP85a1u5pJfGdw13FpZxRCH4zwpmW7RZO7VccUCdPJL8QaECL:2mU81UGd8RCYemWDSKCJZAD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2356	932	regsvr32.exe	28
PID 932 wrote to memory of 2356	932	regsvr32.exe	28
PID 932 wrote to memory of 2356	932	regsvr32.exe	28
PID 932 wrote to memory of 2356	932	regsvr32.exe	28
PID 932 wrote to memory of 2356	932	regsvr32.exe	28
PID 932 wrote to memory of 2356	932	regsvr32.exe	28
PID 932 wrote to memory of 2356	932	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\VAProxyD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\VAProxyD.dll
  2⤵
  PID:2356