zloader | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

description	pid	Process	procid_target
PID 1032 wrote to memory of 3796	1032	regsvr32.exe	72
PID 1032 wrote to memory of 3796	1032	regsvr32.exe	72
PID 1032 wrote to memory of 3796	1032	regsvr32.exe	72
PID 3796 wrote to memory of 2644	3796	regsvr32.exe	80
PID 3796 wrote to memory of 2644	3796	regsvr32.exe	80
PID 3796 wrote to memory of 2644	3796	regsvr32.exe	80
PID 3796 wrote to memory of 2644	3796	regsvr32.exe	80
PID 3796 wrote to memory of 2644	3796	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2644

Network

memory/2644-1-0x0000000002970000-0x00000000029A3000-memory.dmp

Filesize
204KB

Download