94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
133s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:43

Target

Filters/unregister.cmd
Size

98B
MD5

db1bd76ff52fe427a03204673a307b12
SHA1

72232d601dbeee8e448af0cc41d2d517aa56296d
SHA256

6c3cefca10c5e5676a6ef14e8ca472f8f0a11c3ded7391b14acb24bf3d7b727c
SHA512

1bd2065ac82f7d858eded6ef3348d9d3cd5f5dfb2772d351b77f737a2378eaa7d7e05d6008a36a852647446fc60c9a388fa51e7a8f401c6c43fc287d70f10a24

Score

1^/10

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 936	4752	cmd.exe	85
PID 4752 wrote to memory of 936	4752	cmd.exe	85
PID 936 wrote to memory of 436	936	regsvr32.exe	86
PID 936 wrote to memory of 436	936	regsvr32.exe	86
PID 936 wrote to memory of 436	936	regsvr32.exe	86
PID 4752 wrote to memory of 1184	4752	cmd.exe	87
PID 4752 wrote to memory of 1184	4752	cmd.exe	87
PID 1184 wrote to memory of 4124	1184	regsvr32.exe	88
PID 1184 wrote to memory of 4124	1184	regsvr32.exe	88
PID 1184 wrote to memory of 4124	1184	regsvr32.exe	88
PID 4752 wrote to memory of 3240	4752	cmd.exe	89
PID 4752 wrote to memory of 3240	4752	cmd.exe	89
PID 4752 wrote to memory of 776	4752	cmd.exe	90
PID 4752 wrote to memory of 776	4752	cmd.exe	90
PID 776 wrote to memory of 4980	776	regsvr32.exe	91
PID 776 wrote to memory of 4980	776	regsvr32.exe	91
PID 776 wrote to memory of 4980	776	regsvr32.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Filters\unregister.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u /s LC.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\regsvr32.exe
    /u /s LC.dll
    3⤵
    PID:436
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u /s em2vd.ax
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\regsvr32.exe
    /u /s em2vd.ax
    3⤵
    PID:4124
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u /s el2ad.ax
  2⤵
  PID:3240
- C:\Windows\system32\regsvr32.exe
  regsvr32 /u /s elaudec.ax
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\regsvr32.exe
    /u /s elaudec.ax
    3⤵
    PID:4980