dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922

Resubmissions

18/01/2022, 01:59

18/01/2022, 01:25

12/01/2022, 19:02

Target
wTX6pg5eI.dll
Size 470KB
Sample220112-xptnssdgap
SHA256 da7fa800740b478f03c7d6b4be655eaaa52b7607a16491f7c0b34da214d08fc4
MD5 d7558151521bffa1c84e558f961eed25
SHA1 6ff24d8068ecfe17154c7a9d60acb34e8c3af75e
SHA512 f0a9a98542551b6138cd6e05140ca491e4e2990ae55ee97fbdcedc8fd8c4dfa671b00340e9753c536b614f2b909c14769f7d10cbf0fba03183fbf8a6f6f35779
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 1588	600	regsvr32.exe	27
PID 600 wrote to memory of 1588	600	regsvr32.exe	27
PID 600 wrote to memory of 1588	600	regsvr32.exe	27
PID 600 wrote to memory of 1588	600	regsvr32.exe	27
PID 600 wrote to memory of 1588	600	regsvr32.exe	27
PID 600 wrote to memory of 1588	600	regsvr32.exe	27
PID 600 wrote to memory of 1588	600	regsvr32.exe	27
PID 1588 wrote to memory of 1860	1588	regsvr32.exe	30
PID 1588 wrote to memory of 1860	1588	regsvr32.exe	30
PID 1588 wrote to memory of 1860	1588	regsvr32.exe	30
PID 1588 wrote to memory of 1860	1588	regsvr32.exe	30
PID 1588 wrote to memory of 1860	1588	regsvr32.exe	30
PID 1588 wrote to memory of 1860	1588	regsvr32.exe	30
PID 1588 wrote to memory of 1860	1588	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll",DllRegisterServer
    3⤵
    PID:1860

memory/600-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Download

memory/1588-56-0x0000000076151000-0x0000000076153000-memory.dmp

Download

memory/1588-59-0x00000000001D0000-0x00000000001F9000-memory.dmp

Download