16a6baf82a2fb1c366cc6f94c382d55172e72855a5e435c898c6429aab2edd3c

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 23:58

Target
$COMMONFILES/PPLiveNetwork/kernel/VAProxyD.dll
Size 97KB
Sample240408-31hcssfg25
SHA256 02a78e77cb64d9fa1f90ed2be6d9ff7b94624b2a790ed8109bfe61e66ebd825f
MD5 c3a7c71bce4ec04d63b7ef8ec9958c39
SHA1 cbe84ecbae1eb37557426783b7fa89a804d4fc09
SHA512 9a5579cd5c437158d8277b64e583d18cd0113c186d1013e3c57c92d39a16b412ce9f95aef09dbbd05a36cab62e5193532c41eea6850b0a77d8502e7d1fa23468
SSDEEP 1536:2ublP85a1u5pJfGdw13FpZxRCH4zwpmW7RZO7VccUCdPJL8QaECL:2mU81UGd8RCYemWDSKCJZAD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1684	2516	regsvr32.exe	87
PID 2516 wrote to memory of 1684	2516	regsvr32.exe	87
PID 2516 wrote to memory of 1684	2516	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\VAProxyD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\VAProxyD.dll
  2⤵
  PID:1684