61f02800d354dd577abc3ff1562c09de6dc6ee344640b37b7ccd3f53ca3d3dfa

Analysis

user interaction
yes
max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iZotope Ozone12 Neutron5 Delete SymLink.cmd
Size 5KB
Sample260709-wd7kvaez8p
SHA256 61f02800d354dd577abc3ff1562c09de6dc6ee344640b37b7ccd3f53ca3d3dfa
MD5 444d322067c9d34d72aaead542d4642e
SHA1 4ae469870dfe79d6f70f9780ed92553d0d7501a1
SHA512 d8bfdb843434ad083692aafd0ae37757abf762a67f67c682d0e77ae55ca2e7af3d935ff113181c2af1cc97876bfaf5dd4f4be445899fe12f260c74df0f3ac732
SSDEEP 48:YNg9pwp3KtHKMqHOHXF31A1MZ/SgdaNyXvAsPJrH9mY5Zh1n41QcaY7BK7E4epBF:YNgU8QQcahVecI8hFU
TLSH
T19FC1611624365D150AD361800FABD4D16BB4A2AAB6CF8BC075FCFA80672DED342AC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2972	2188	cmd.exe	89
PID 2188 wrote to memory of 1900	2188	cmd.exe	90
PID 2188 wrote to memory of 1108	2188	cmd.exe	91
PID 2188 wrote to memory of 4960	2188	cmd.exe	92
PID 2188 wrote to memory of 3704	2188	cmd.exe	93
PID 2188 wrote to memory of 6088	2188	cmd.exe	94
PID 2188 wrote to memory of 2920	2188	cmd.exe	95
PID 2188 wrote to memory of 2284	2188	cmd.exe	96
PID 2188 wrote to memory of 1992	2188	cmd.exe	97
PID 2188 wrote to memory of 4416	2188	cmd.exe	98
PID 2188 wrote to memory of 1748	2188	cmd.exe	99
PID 2188 wrote to memory of 5812	2188	cmd.exe	100
PID 2188 wrote to memory of 5536	2188	cmd.exe	101
PID 2188 wrote to memory of 5528	2188	cmd.exe	102
PID 2188 wrote to memory of 4668	2188	cmd.exe	103
PID 2188 wrote to memory of 2256	2188	cmd.exe	104
PID 2188 wrote to memory of 2872	2188	cmd.exe	105
PID 2188 wrote to memory of 1040	2188	cmd.exe	106
PID 2188 wrote to memory of 2152	2188	cmd.exe	107
PID 2188 wrote to memory of 564	2188	cmd.exe	108
PID 2188 wrote to memory of 3212	2188	cmd.exe	109
PID 2188 wrote to memory of 2868	2188	cmd.exe	110
PID 2188 wrote to memory of 5848	2188	cmd.exe	111
PID 2188 wrote to memory of 3000	2188	cmd.exe	112
PID 2188 wrote to memory of 1248	2188	cmd.exe	113
PID 2188 wrote to memory of 5236	2188	cmd.exe	114
PID 2188 wrote to memory of 672	2188	cmd.exe	115
PID 2188 wrote to memory of 4544	2188	cmd.exe	116
PID 2188 wrote to memory of 1948	2188	cmd.exe	117
PID 2188 wrote to memory of 5188	2188	cmd.exe	118
PID 2188 wrote to memory of 5588	2188	cmd.exe	119
PID 2188 wrote to memory of 5484	2188	cmd.exe	120
PID 2188 wrote to memory of 2700	2188	cmd.exe	121
PID 2188 wrote to memory of 5948	2188	cmd.exe	122
PID 2188 wrote to memory of 2828	2188	cmd.exe	123
PID 2188 wrote to memory of 1220	2188	cmd.exe	124
PID 2188 wrote to memory of 5644	2188	cmd.exe	125
PID 2188 wrote to memory of 5704	2188	cmd.exe	126
PID 2188 wrote to memory of 5988	2188	cmd.exe	127
PID 2188 wrote to memory of 2240	2188	cmd.exe	128
PID 2188 wrote to memory of 1052	2188	cmd.exe	129
PID 2188 wrote to memory of 5568	2188	cmd.exe	130
PID 2188 wrote to memory of 5032	2188	cmd.exe	131
PID 2188 wrote to memory of 2164	2188	cmd.exe	132
PID 2188 wrote to memory of 1972	2188	cmd.exe	133
PID 2188 wrote to memory of 2144	2188	cmd.exe	134
PID 2188 wrote to memory of 5020	2188	cmd.exe	135
PID 2188 wrote to memory of 4660	2188	cmd.exe	136
PID 2188 wrote to memory of 4616	2188	cmd.exe	137
PID 2188 wrote to memory of 3876	2188	cmd.exe	138
PID 2188 wrote to memory of 1480	2188	cmd.exe	139
PID 2188 wrote to memory of 3148	2188	cmd.exe	140
PID 2188 wrote to memory of 3540	2188	cmd.exe	141
PID 2188 wrote to memory of 5440	2188	cmd.exe	142
PID 2188 wrote to memory of 4892	2188	cmd.exe	143
PID 2188 wrote to memory of 3880	2188	cmd.exe	144
PID 2188 wrote to memory of 1056	2188	cmd.exe	145
PID 2188 wrote to memory of 5776	2188	cmd.exe	146
PID 2188 wrote to memory of 2656	2188	cmd.exe	147
PID 2188 wrote to memory of 2104	2188	cmd.exe	148
PID 2188 wrote to memory of 1496	2188	cmd.exe	149
PID 2188 wrote to memory of 956	2188	cmd.exe	150
PID 2188 wrote to memory of 1688	2188	cmd.exe	151
PID 2188 wrote to memory of 5544	2188	cmd.exe	152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\iZotope Ozone12 Neutron5 Delete SymLink.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\chcp.com
  chcp 1251
  2⤵
  PID:2972
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:1900
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5" /f
  2⤵
  PID:1108
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5CLIPPER" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5COMP" /f
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5DENSITY" /f
  2⤵
  PID:6088
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5EQ" /f
  2⤵
  PID:2920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5EXCR" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5GATE" /f
  2⤵
  PID:1992
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5MS" /f
  2⤵
  PID:4416
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5PHASE" /f
  2⤵
  PID:1748
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5SCUL" /f
  2⤵
  PID:5812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5TRAN" /f
  2⤵
  PID:5536
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5UNMASK" /f
  2⤵
  PID:5528
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\NEUTRON5VM" /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12" /f
  2⤵
  PID:2256
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12BASS" /f
  2⤵
  PID:2872
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12CLTY" /f
  2⤵
  PID:1040
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12DYN" /f
  2⤵
  PID:2152
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12DYNEQ" /f
  2⤵
  PID:564
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12EQ" /f
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12EXCR" /f
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12IMG" /f
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12IMP" /f
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12LEF" /f
  2⤵
  PID:1248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12MAX" /f
  2⤵
  PID:5236
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12MEQ" /f
  2⤵
  PID:672
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12MREBAL" /f
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12MS" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12SSHPR" /f
  2⤵
  PID:5188
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12STBL" /f
  2⤵
  PID:5588
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12STEMEQ" /f
  2⤵
  PID:5484
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12UNLIMITER" /f
  2⤵
  PID:2700
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12VCOMP" /f
  2⤵
  PID:5948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12VEQ" /f
  2⤵
  PID:2828
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12VLIM" /f
  2⤵
  PID:1220
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\OZONE12VTAPE" /f
  2⤵
  PID:5644
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5CLIPPER" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5COMP" /f
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5DENSITY" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5EQ" /f
  2⤵
  PID:1052
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5EXCR" /f
  2⤵
  PID:5568
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5GATE" /f
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5MS" /f
  2⤵
  PID:2164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5PHASE" /f
  2⤵
  PID:1972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5SCUL" /f
  2⤵
  PID:2144
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5TRAN" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5UNMASK" /f
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\NEUTRON5VM" /f
  2⤵
  PID:4616
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12BASS" /f
  2⤵
  PID:3876
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12CLTY" /f
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12DYN" /f
  2⤵
  PID:3148
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12DYNEQ" /f
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12EQ" /f
  2⤵
  PID:5440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12EXCR" /f
  2⤵
  PID:4892
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12IMG" /f
  2⤵
  PID:3880
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12IMP" /f
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12LEF" /f
  2⤵
  PID:5776
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12MAX" /f
  2⤵
  PID:2656
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12MEQ" /f
  2⤵
  PID:2104
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12MREBAL" /f
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12MS" /f
  2⤵
  PID:956
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12SSHPR" /f
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12STBL" /f
  2⤵
  PID:5544
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12STEMEQ" /f
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12UNLIMITER" /f
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12VCOMP" /f
  2⤵
  PID:1296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12VEQ" /f
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12VLIM" /f
  2⤵
  PID:5132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\OZONE12VTAPE" /f
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\SharedDataMux3" /f
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\RELAY" /f
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\RELAY" /f
  2⤵
  PID:4804
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\SOFTWARE\iZotope\INSIGHT2" /f
  2⤵
  PID:3812
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\iZotope\INSIGHT2" /f
  2⤵
  PID:1696

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads