eeed7afd78dddae6f6c222b955fa1ca656b48fa2e04f87db11092dc87d2c86ee

Analysis

max time kernel
146s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
18/07/2024, 11:02

Target
LoaderV4.4/PhysxExt.dll
Size 2.9MB
Sample240718-m5keysvgpl
SHA256 224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f
MD5 6ff985653d41e8d60bb1293f01729adf
SHA1 1ae3086a16a91ea45c06d34071d8b3b87e058804
SHA512 fd47a81000dcd98adc03d1f45a172c19b2e8aa3c8f13338bda0b00407f7b81b52e0fa9be3f9ef87fb1303231225e83b9dd8c39a0777ee56ccd54abc52d095b87
SSDEEP 24576:fZJJSVBjkvvhwVxKKpQgRQ8sUOwDUsHeHfcKtaPRO/o5o4Z/5rLyv+Fe:xJegvvhTKTRcPDqho4F5rLyW4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4660	3216	regsvr32.exe	78
PID 3216 wrote to memory of 4660	3216	regsvr32.exe	78
PID 3216 wrote to memory of 4660	3216	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LoaderV4.4\PhysxExt.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\LoaderV4.4\PhysxExt.dll
  2⤵
  PID:4660