3fd157484c55d7b3871ed546865836985ec4995a38fae1b1719ceed6dfb5bb67

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 21:20

Target

Kernel/PPStream/vodres.dll
Size

377KB
MD5

8fef394fe6e391a20fc0de77dafbd50b
SHA1

7c43af316d22cdbe83cb8cbb24ff394ae426ad65
SHA256

274d9bd46a73f1be410aa40297ba122fb19ce022dac0ad003a75cad8b659995e
SHA512

e9002f17fe0eb24c3a6ec70363f042e309166d49dc5419d0adc06a7b0d5488d025d6fa07a2d4d13e4da622d8a24b5401aae8f2446e88e00e8f064b8abfdc661c
SSDEEP

6144:iGFCZPJD0HvWlBGs9AcE+Z7ClDnLMIhGe7/J4rS1PhBO638rNOy1Aah4E5w1UKU:iGFCZPJgHvWlBGsucE+Z7CVnLMIhGc/g

Score

1^/10

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ppstreamvodres	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppstreamvodres\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kernel\\PPStream\\vodres.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3776	3780	regsvr32.exe	83
PID 3780 wrote to memory of 3776	3780	regsvr32.exe	83
PID 3780 wrote to memory of 3776	3780	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\vodres.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\vodres.dll
  2⤵
  - Modifies registry class
  PID:3776