95d0c9be9dd4608bf0e971214ee40f636cff9f50503eadb6b5ea832dfc08ad4c

Analysis

Target
4c9f1df55a43b1f2348898cde6dda88b.dll
Size 1.4MB
Sample220113-1d9gnacfem
SHA256 95d0c9be9dd4608bf0e971214ee40f636cff9f50503eadb6b5ea832dfc08ad4c
MD5 4c9f1df55a43b1f2348898cde6dda88b
SHA1 0f26530f8eaecf2ebd8fb38dd93393105bd7b7b8
SHA512 d66f551547e471607598006e64b0a297064975c573e36c79cb0a86a9afaa8211dabb732eae2c2d3b3b8a4ba94e4b58691e9409f0c4a0e03f706d7b429872582f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3552	3452	regsvr32.exe	68
PID 3452 wrote to memory of 3552	3452	regsvr32.exe	68
PID 3452 wrote to memory of 3552	3452	regsvr32.exe	68
PID 3552 wrote to memory of 3680	3552	regsvr32.exe	69
PID 3552 wrote to memory of 3680	3552	regsvr32.exe	69
PID 3552 wrote to memory of 3680	3552	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4c9f1df55a43b1f2348898cde6dda88b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4c9f1df55a43b1f2348898cde6dda88b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4c9f1df55a43b1f2348898cde6dda88b.dll",DllRegisterServer
    3⤵
    PID:3680

memory/3552-117-0x0000000004CE0000-0x0000000004D08000-memory.dmp

Download