69023ebf4294a7260018f73d263cf363878833a307bc2cd28ad694ce0d50435a

Analysis

Target
f3a2565e509a1afac5491d4b834dc03f.dll
Size 745KB
Sample220111-17cpsahhep
SHA256 69023ebf4294a7260018f73d263cf363878833a307bc2cd28ad694ce0d50435a
MD5 f3a2565e509a1afac5491d4b834dc03f
SHA1 9d327490c989fa20de03e7e6592e123f0bcbf391
SHA512 15e7e52ac9c2c9ccb5abe9d966b8b6394069aeca567ae9d45ff1a3b2e9ebbf8ed693048841604d6e81375ee8bb0569ed0febc2e5d735b8782628f0768881c138
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2116	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2116	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2116	2680	regsvr32.exe	68
PID 2116 wrote to memory of 852	2116	regsvr32.exe	69
PID 2116 wrote to memory of 852	2116	regsvr32.exe	69
PID 2116 wrote to memory of 852	2116	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3a2565e509a1afac5491d4b834dc03f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f3a2565e509a1afac5491d4b834dc03f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f3a2565e509a1afac5491d4b834dc03f.dll",DllRegisterServer
    3⤵
    PID:852

memory/2116-120-0x0000000004305000-0x0000000004306000-memory.dmp

Download

memory/2116-119-0x00000000042E1000-0x0000000004305000-memory.dmp

Download