eeed7afd78dddae6f6c222b955fa1ca656b48fa2e04f87db11092dc87d2c86ee

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 20:59

Target

LoaderV4.4/PhysxExt.dll
Size

2.9MB
MD5

6ff985653d41e8d60bb1293f01729adf
SHA1

1ae3086a16a91ea45c06d34071d8b3b87e058804
SHA256

224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f
SHA512

fd47a81000dcd98adc03d1f45a172c19b2e8aa3c8f13338bda0b00407f7b81b52e0fa9be3f9ef87fb1303231225e83b9dd8c39a0777ee56ccd54abc52d095b87
SSDEEP

24576:fZJJSVBjkvvhwVxKKpQgRQ8sUOwDUsHeHfcKtaPRO/o5o4Z/5rLyv+Fe:xJegvvhTKTRcPDqho4F5rLyW4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1780	5072	regsvr32.exe	85
PID 5072 wrote to memory of 1780	5072	regsvr32.exe	85
PID 5072 wrote to memory of 1780	5072	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LoaderV4.4\PhysxExt.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\LoaderV4.4\PhysxExt.dll
  2⤵
  PID:1780