3fd157484c55d7b3871ed546865836985ec4995a38fae1b1719ceed6dfb5bb67

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 21:20

Target

Kernel/PPStream/ppssg.dll
Size

153KB
MD5

6cf88e7279230a0b7dbbc0c16973e3a5
SHA1

13c1fb4805a274acf6067ba2c47c5835926ba176
SHA256

007dc966aa1882815d9752532005e11e2fdda207a53804506f18a0ec8d228965
SHA512

87a14c976e3f2e7338df0a8e5e290982419186dc89e4f08792e6e5fe97b3e070833bbc8b4102f545707aec0aef8be7eeecf7efc7ea2ef6ba3fe2b87b6e19df4b
SSDEEP

3072:UNqZDt9k2iBehCsL9XH4k2aQqxbN3By/EkBm0SJ2lj+gYE:UNQDta2iBehCsLNH4k2aQ0hBQBlx6E

Score

1^/10

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ppstreamSG	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppstreamSG\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kernel\\PPStream\\ppssg.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\ppssg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\ppssg.dll
  2⤵
  - Modifies registry class
  PID:2628