31c043f56f0c911dfcb0208a87783bfbdbc46f9c145b62d4e36f5b80f049005f

Analysis

Target
5e9d56eb2c039e272e646e9fe7c6a7b2.dll
Size 1.4MB
Sample220113-1d79lacfek
SHA256 31c043f56f0c911dfcb0208a87783bfbdbc46f9c145b62d4e36f5b80f049005f
MD5 5e9d56eb2c039e272e646e9fe7c6a7b2
SHA1 9fda658aba2a52768669754328b09b5550d4855a
SHA512 a85f239d7ca00d2b42dec53155df26f559294008b858588861bca8d7f8f2278a007555f6398a6dd30461e85d3786616bf0d0c303ec24e3afeb65d6135f96f4cf
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1872	940	regsvr32.exe	27
PID 940 wrote to memory of 1872	940	regsvr32.exe	27
PID 940 wrote to memory of 1872	940	regsvr32.exe	27
PID 940 wrote to memory of 1872	940	regsvr32.exe	27
PID 940 wrote to memory of 1872	940	regsvr32.exe	27
PID 940 wrote to memory of 1872	940	regsvr32.exe	27
PID 940 wrote to memory of 1872	940	regsvr32.exe	27
PID 1872 wrote to memory of 564	1872	regsvr32.exe	28
PID 1872 wrote to memory of 564	1872	regsvr32.exe	28
PID 1872 wrote to memory of 564	1872	regsvr32.exe	28
PID 1872 wrote to memory of 564	1872	regsvr32.exe	28
PID 1872 wrote to memory of 564	1872	regsvr32.exe	28
PID 1872 wrote to memory of 564	1872	regsvr32.exe	28
PID 1872 wrote to memory of 564	1872	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e9d56eb2c039e272e646e9fe7c6a7b2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5e9d56eb2c039e272e646e9fe7c6a7b2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5e9d56eb2c039e272e646e9fe7c6a7b2.dll",DllRegisterServer
    3⤵
    PID:564

memory/940-53-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download

memory/1872-55-0x0000000076121000-0x0000000076123000-memory.dmp

Download

memory/1872-58-0x0000000000690000-0x0000000000710000-memory.dmp

Download