d016ff5780b21ae7f1359124b4752cf4f9639ff638c1c69a279701dcc9c27449

Analysis

max time kernel
137s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 11:43

Target

PortableDeviceConnectApi.dll
Size

55KB
MD5

7935bac5c8b09b198de9167ab3c5a426
SHA1

ff3964810a89d233f11b48cec3a6830cb898a043
SHA256

d016ff5780b21ae7f1359124b4752cf4f9639ff638c1c69a279701dcc9c27449
SHA512

0536680cedd923b2d56312fbdbe6007344176216d4999543084490c52c623a9837c57af85ee262e6b99ab31f6c9650e4a7493b0a564f8547464b8c7cb16fc3f0
SSDEEP

768:duF65zybuRgf2bbu87PdboT+uS6x+OMsB/x9urDfBDEXIICr4peEswPi5jg3rM:w64buRf7P1oTfxzqHBDpIU4QEsw6

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8FE73967-AAE2-4D77-9921-0C4962631056}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8FE73967-AAE2-4D77-9921-0C4962631056}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8FE73967-AAE2-4D77-9921-0C4962631056}\1.0\HELPDIR	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4556	3980	regsvr32.exe	82
PID 3980 wrote to memory of 4556	3980	regsvr32.exe	82
PID 3980 wrote to memory of 4556	3980	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PortableDeviceConnectApi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\PortableDeviceConnectApi.dll
  2⤵
  - Modifies registry class
  PID:4556