d7d47aa5796cad499374b284e865f715e7496efca16566add1c3a505730259de | Triage

Analysis

max time kernel
91s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 06:48

Sharing

Report Analysis Logs

General

Target

kislivx.dll
Size

835KB
MD5

78c9fb4bdce3d41b2a945371ddcf8130
SHA1

38f37dfca519c870860be3d6588b96111fb2abf2
SHA256

338f9ad6281703b4104db80e20df683a67d837a76414f488142943dcd684fb09
SHA512

dca9e620314a2b77d0969348aaa4fcae2b3c5b71e1bd30b82a21ede5fbf8ed31d2612d0ce7b16f0f3f3c7cc4752eea50613f9d89f5cb6ce6ac40dd23dec9cec1
SSDEEP

24576:sZEVwAGGopOiHTfXQ6r/v0ReBcTr5UY+RVvo7F:suapOizA6r/v0oOTNqfvo7F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1928	368	regsvr32.exe	80
PID 368 wrote to memory of 1928	368	regsvr32.exe	80
PID 368 wrote to memory of 1928	368	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kislivx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kislivx.dll
  2⤵
  PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads