e66d33caff1a5048e4a5b05e52de6b92957aadd9663265afe495965f9769a725

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 18:14

Target

$_2_/SSOPlatform.dll
Size

1.6MB
MD5

05775808640bed11a61d20aa6151eea9
SHA1

e58e28c08337ae8af061018028196e8037489bd5
SHA256

8267cf773bd9bfee3e7c414c676b71cb897dcc114b666366e0cd3a8a8a380b75
SHA512

1d0f9262ec1c27b2ab9f6f0f53d612c88f6213c10a0cbde01cbb93d9ee47efb51010260212a5f281295121db22acf9557e167694e92d9a479b5f109c34d267a5
SSDEEP

24576:rZ1nnTZ4JIonvTW68lkgh1bitG4tUNQdMc+92Mx55pL1iBUmz+IWt8kbqyI:rZ6v/gh1bitGaUGU2c55Ngz+v8kbqyI

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{779B9A29-7837-447C-BF6E-42A63099C3ED}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{779B9A29-7837-447C-BF6E-42A63099C3ED}\ = "SSOPlatformDllBuild"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SSOPlatformDllBuild.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SSOPlatformDllBuild.DLL\AppID = "{779B9A29-7837-447C-BF6E-42A63099C3ED}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1044	4472	regsvr32.exe	83
PID 4472 wrote to memory of 1044	4472	regsvr32.exe	83
PID 4472 wrote to memory of 1044	4472	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_2_\SSOPlatform.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$_2_\SSOPlatform.dll
  2⤵
  - Modifies registry class
  PID:1044