4bf2f4dd9ecaa28ecebae186a118cf66f8fce7ee8790351ca7224516ff47010e

Analysis

Target
SecuriteInfo.com.Win32.Kryptik.HDJT.24059.dll
Size 3.3MB
Sample201109-lcacbp994j
SHA256 4bf2f4dd9ecaa28ecebae186a118cf66f8fce7ee8790351ca7224516ff47010e
MD5 8990fc5d6e3a229670ad362539c50225
SHA1 78726931abdc2d3046974bc1266e6a2732dfa25b
SHA512 f966d7ab97ca1f2a8dcb6f4a5c4282dbaf460d3b618343ae2ade95743dd8fd55e98e1b9ac79f50c514d80e5e3fab096489cc268325959a2fc3018ba0b75d5fdd
MD5 SHA1 SHA512

Score

8^/10

Blacklisted process makes network request 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1636	580	regsvr32.exe	73
PID 580 wrote to memory of 1636	580	regsvr32.exe	73
PID 580 wrote to memory of 1636	580	regsvr32.exe	73
PID 1636 wrote to memory of 1180	1636	regsvr32.exe	79
PID 1636 wrote to memory of 1180	1636	regsvr32.exe	79
PID 1636 wrote to memory of 1180	1636	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDJT.24059.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDJT.24059.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDJT.24059.dll,f0
    3⤵
    - Blacklisted process makes network request
    PID:1180