c4c42895b85b6b49d9dcaf6e8bab1c05e50ba878deb06bcc5d2d4559ace8a582

Analysis

Target
b6b55d166aa0c4583bb04818f13149a7.dll
Size 736KB
Sample220113-j7afzsgfe3
SHA256 c4c42895b85b6b49d9dcaf6e8bab1c05e50ba878deb06bcc5d2d4559ace8a582
MD5 b6b55d166aa0c4583bb04818f13149a7
SHA1 59c11c168555ad3f07df70386bbb327979d91df6
SHA512 f463eed8e91442283820d1a37f153de113fcb6a770189651c36bea038755084c0730f5b73ba2851c0efbe975b2af8e99d45b310e13b0b17b8ed117123f5e6f6d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2668	2460	regsvr32.exe	69
PID 2460 wrote to memory of 2668	2460	regsvr32.exe	69
PID 2460 wrote to memory of 2668	2460	regsvr32.exe	69
PID 2668 wrote to memory of 3412	2668	regsvr32.exe	70
PID 2668 wrote to memory of 3412	2668	regsvr32.exe	70
PID 2668 wrote to memory of 3412	2668	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6b55d166aa0c4583bb04818f13149a7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b6b55d166aa0c4583bb04818f13149a7.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b6b55d166aa0c4583bb04818f13149a7.dll",DllRegisterServer
    3⤵
    PID:3412

memory/2668-119-0x0000000000C31000-0x0000000000C55000-memory.dmp

Download

memory/2668-120-0x0000000000C55000-0x0000000000C56000-memory.dmp

Download