0ac9d35e38861a4c3af3d55c0ec7e22bd44cd2957bcdebe88f21fb84e7bf2d0e

Analysis

Target
65222c0a2699f9088bc9257c5bd0efb2.dll
Size 736KB
Sample220113-j6pjhsgfd8
SHA256 0ac9d35e38861a4c3af3d55c0ec7e22bd44cd2957bcdebe88f21fb84e7bf2d0e
MD5 65222c0a2699f9088bc9257c5bd0efb2
SHA1 f90608fc7b68d0a1a3353e20b56a8e0a9114e150
SHA512 4d1ca8718c9e70ea7856da8e92b92dd66bc16c8d09ed538b73687c4d3d8445b97b782667e95b6658d93e0ce9fab8e9a2e861f1f3a4cca139f78540e09663dbed
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2608	2368	regsvr32.exe	68
PID 2368 wrote to memory of 2608	2368	regsvr32.exe	68
PID 2368 wrote to memory of 2608	2368	regsvr32.exe	68
PID 2608 wrote to memory of 2692	2608	regsvr32.exe	69
PID 2608 wrote to memory of 2692	2608	regsvr32.exe	69
PID 2608 wrote to memory of 2692	2608	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\65222c0a2699f9088bc9257c5bd0efb2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\65222c0a2699f9088bc9257c5bd0efb2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\65222c0a2699f9088bc9257c5bd0efb2.dll",DllRegisterServer
    3⤵
    PID:2692

memory/2608-117-0x0000000002C45000-0x0000000002C46000-memory.dmp

Download