7eff7a8ce230d5fbad73754300c7ea03d3b0dd63efc631de13a24d8a61c34c9f

Analysis

Target
92f260f8997d1b0e6565ae881fc35eaa.dll
Size 736KB
Sample220113-jptrxaged4
SHA256 7eff7a8ce230d5fbad73754300c7ea03d3b0dd63efc631de13a24d8a61c34c9f
MD5 92f260f8997d1b0e6565ae881fc35eaa
SHA1 b703ef9535bb86c3717102a5838bc9dcc121a51a
SHA512 51997c5ec1bb17aae8f4b9be9544157bde85ecaf591ec58140c9fe8745389db10b19e7b8b5ac710f76afb2516aa8945bca6de65adb66c07061c35a71052954cf
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1796	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1796	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1796	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1796	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1796	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1796	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1796	1180	regsvr32.exe	27
PID 1796 wrote to memory of 1144	1796	regsvr32.exe	28
PID 1796 wrote to memory of 1144	1796	regsvr32.exe	28
PID 1796 wrote to memory of 1144	1796	regsvr32.exe	28
PID 1796 wrote to memory of 1144	1796	regsvr32.exe	28
PID 1796 wrote to memory of 1144	1796	regsvr32.exe	28
PID 1796 wrote to memory of 1144	1796	regsvr32.exe	28
PID 1796 wrote to memory of 1144	1796	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\92f260f8997d1b0e6565ae881fc35eaa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\92f260f8997d1b0e6565ae881fc35eaa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\92f260f8997d1b0e6565ae881fc35eaa.dll",DllRegisterServer
    3⤵
    PID:1144

memory/1180-55-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Download

memory/1796-57-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1796-59-0x0000000000315000-0x0000000000316000-memory.dmp

Download

memory/1796-58-0x00000000002F1000-0x0000000000315000-memory.dmp

Download