77184f1532fef0b593262fdd95ff1f2d2637fe08be003304d4e44f358c67b2d1

Analysis

Target

ISLeRPs.dll
Size

744KB
MD5

34379df22c95ed0f82ccb5f91f8a7069
SHA1

5bf00c67f45de592866b2fc91963dc83057390f4
SHA256

77184f1532fef0b593262fdd95ff1f2d2637fe08be003304d4e44f358c67b2d1
SHA512

bd446f119df944c9c7ea0603e3b05f893d030b337163cd527c00c0f601ea24ceabdc77f26103e9002daac0597d6e390b8ebf3296bc904f469d243f235c4cd35e

Score

8^/10

Blocklisted process makes network request 9 IoCs

Processes:

msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1812 set thread context of 2368 1812 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2368 msiexec.exe
Token: SeSecurityPrivilege 2368 msiexec.exe

description	pid	process	target process
PID 1812 set thread context of 2368	1812	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2368	msiexec.exe
Token: SeSecurityPrivilege	2368	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 636 wrote to memory of 1812	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1812	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1812	636	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 2368	1812	regsvr32.exe	msiexec.exe
PID 1812 wrote to memory of 2368	1812	regsvr32.exe	msiexec.exe
PID 1812 wrote to memory of 2368	1812	regsvr32.exe	msiexec.exe
PID 1812 wrote to memory of 2368	1812	regsvr32.exe	msiexec.exe
PID 1812 wrote to memory of 2368	1812	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ISLeRPs.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ISLeRPs.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:2368

memory/1812-2-0x0000000000000000-mapping.dmp

Download
memory/1812-3-0x0000000073D30000-0x0000000073D59000-memory.dmp

Filesize
164KB

Download
memory/1812-4-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/2368-5-0x0000000000000000-mapping.dmp

Download
memory/2368-6-0x0000000002EF0000-0x0000000002F19000-memory.dmp

Filesize
164KB

Download