9991ba190c39e15e512629b7194b902a4dd2726a7fc6c6531a78e4c5ea77695f

Analysis

Target
8c8fd7c65fbada46a15857f047857880.dll
Size 745KB
Sample220111-2c3s6aaaak
SHA256 9991ba190c39e15e512629b7194b902a4dd2726a7fc6c6531a78e4c5ea77695f
MD5 8c8fd7c65fbada46a15857f047857880
SHA1 059bc5da52e76fe0d51c6775191987ffa221f11f
SHA512 11db971e24014b3314d399ee872229e55705eba47952d759e6551dc9ee0aeb12d2bc2434df118af62c2ca98d4519b9d77a90069ab5c2cfe198f29c2f04b22ad6
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 3444	3376	regsvr32.exe	68
PID 3376 wrote to memory of 3444	3376	regsvr32.exe	68
PID 3376 wrote to memory of 3444	3376	regsvr32.exe	68
PID 3444 wrote to memory of 3672	3444	regsvr32.exe	69
PID 3444 wrote to memory of 3672	3444	regsvr32.exe	69
PID 3444 wrote to memory of 3672	3444	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8c8fd7c65fbada46a15857f047857880.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8c8fd7c65fbada46a15857f047857880.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8c8fd7c65fbada46a15857f047857880.dll",DllRegisterServer
    3⤵
    PID:3672

memory/3444-117-0x0000000004525000-0x0000000004526000-memory.dmp

Download

memory/3444-116-0x0000000004501000-0x0000000004525000-memory.dmp

Download