dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922

Resubmissions

18/01/2022, 01:59

18/01/2022, 01:25

12/01/2022, 19:02

Target
r5t3fovxD.dll
Size 470KB
Sample220112-xptnssdgap
SHA256 da9365e086fb31ed7d832365cf96ffd2697d47f12deb8bf34bd5b1a50870299e
MD5 3eed9d1f62e0ae2678a708e9aaea2e83
SHA1 a30470351ad507f1bf12d11e7c6008f2e821cd98
SHA512 334a23dca68b451c213c74ff0b8363dafd6de8ac0807999b11c60b00e889f19312629ad842d1a0f3f2c7a65465522905155303055a7ab18709b8d9a4ac781551
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1720	964	regsvr32.exe	27
PID 964 wrote to memory of 1720	964	regsvr32.exe	27
PID 964 wrote to memory of 1720	964	regsvr32.exe	27
PID 964 wrote to memory of 1720	964	regsvr32.exe	27
PID 964 wrote to memory of 1720	964	regsvr32.exe	27
PID 964 wrote to memory of 1720	964	regsvr32.exe	27
PID 964 wrote to memory of 1720	964	regsvr32.exe	27
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	28
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	28
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	28
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	28
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	28
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	28
PID 1720 wrote to memory of 1796	1720	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\r5t3fovxD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\r5t3fovxD.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\r5t3fovxD.dll",DllRegisterServer
    3⤵
    PID:1796

memory/964-53-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/1720-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1720-58-0x00000000001C0000-0x00000000001E9000-memory.dmp

Download