dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922

Resubmissions

18/01/2022, 01:59

18/01/2022, 01:25

12/01/2022, 19:02

Target
NTn5cqpa.dll
Size 470KB
Sample220112-xptnssdgap
SHA256 c60f319790c8cf0b2f39046c789428771ed2bf8f4c108d9b6e9c9bf024efd3c2
MD5 e4b28480c44a175190085a79e50aa56c
SHA1 3e43969468de455940920664b28cc0c8139924b6
SHA512 2dfaa66429f27de1a8b86e693f2776eae593b671d1ae385ed3389e7ff528b4582e6a6695474123febfc34749c9aa2308c2b90b5c43bd41cd1d88a5e0a4b12964
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1052	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1052	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1052	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1052	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1052	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1052	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1052	1560	regsvr32.exe	27
PID 1052 wrote to memory of 1752	1052	regsvr32.exe	30
PID 1052 wrote to memory of 1752	1052	regsvr32.exe	30
PID 1052 wrote to memory of 1752	1052	regsvr32.exe	30
PID 1052 wrote to memory of 1752	1052	regsvr32.exe	30
PID 1052 wrote to memory of 1752	1052	regsvr32.exe	30
PID 1052 wrote to memory of 1752	1052	regsvr32.exe	30
PID 1052 wrote to memory of 1752	1052	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NTn5cqpa.dll",DllRegisterServer
    3⤵
    PID:1752

memory/1052-57-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1052-60-0x0000000000180000-0x00000000001A9000-memory.dmp

Download

memory/1560-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download