24ddbfd580892c7c8296443b2984d8b8a75ace197a7ad73a8b9ada6bf36dcf7d

Analysis

Target
Jg3IeIbuQ3.dll
Size 470KB
Sample220112-mstsvscdbp
SHA256 24ddbfd580892c7c8296443b2984d8b8a75ace197a7ad73a8b9ada6bf36dcf7d
MD5 ca11d65999837dbdf40585054063e265
SHA1 59ddfbf27ba64f4a7566ec0a96e4574557eb6a28
SHA512 6bd4f91259ac1afa4e8939bcbe4769d8d60c4164917cf8eaaa914dc3fd6a1fee29d8a768579725f01cbcce21780a4ad4a829a8da49cae35cd94da7ea2a2a3b9e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1772	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1772	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1772	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1772	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1772	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1772	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1772	1536	regsvr32.exe	27
PID 1772 wrote to memory of 816	1772	regsvr32.exe	30
PID 1772 wrote to memory of 816	1772	regsvr32.exe	30
PID 1772 wrote to memory of 816	1772	regsvr32.exe	30
PID 1772 wrote to memory of 816	1772	regsvr32.exe	30
PID 1772 wrote to memory of 816	1772	regsvr32.exe	30
PID 1772 wrote to memory of 816	1772	regsvr32.exe	30
PID 1772 wrote to memory of 816	1772	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Jg3IeIbuQ3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Jg3IeIbuQ3.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Jg3IeIbuQ3.dll",DllRegisterServer
    3⤵
    PID:816

memory/1536-55-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Download

memory/1772-57-0x0000000076371000-0x0000000076373000-memory.dmp

Download

memory/1772-60-0x0000000000210000-0x0000000000239000-memory.dmp

Download