7eff7a8ce230d5fbad73754300c7ea03d3b0dd63efc631de13a24d8a61c34c9f

Analysis

Target
92f260f8997d1b0e6565ae881fc35eaa.dll
Size 736KB
Sample220113-jptrxaged4
SHA256 7eff7a8ce230d5fbad73754300c7ea03d3b0dd63efc631de13a24d8a61c34c9f
MD5 92f260f8997d1b0e6565ae881fc35eaa
SHA1 b703ef9535bb86c3717102a5838bc9dcc121a51a
SHA512 51997c5ec1bb17aae8f4b9be9544157bde85ecaf591ec58140c9fe8745389db10b19e7b8b5ac710f76afb2516aa8945bca6de65adb66c07061c35a71052954cf
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 2064	948	regsvr32.exe	68
PID 948 wrote to memory of 2064	948	regsvr32.exe	68
PID 948 wrote to memory of 2064	948	regsvr32.exe	68
PID 2064 wrote to memory of 3052	2064	regsvr32.exe	70
PID 2064 wrote to memory of 3052	2064	regsvr32.exe	70
PID 2064 wrote to memory of 3052	2064	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\92f260f8997d1b0e6565ae881fc35eaa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\92f260f8997d1b0e6565ae881fc35eaa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\92f260f8997d1b0e6565ae881fc35eaa.dll",DllRegisterServer
    3⤵
    PID:3052

memory/2064-117-0x00000000041A5000-0x00000000041A6000-memory.dmp

Download

memory/2064-116-0x0000000004181000-0x00000000041A5000-memory.dmp

Download