a7e00ca1925286a6d095bee734373eaf1a2683389e1071ad0ff9cc774c55976e

Analysis

Target
722d28896ba85e533591d953bf32e790.dll
Size 736KB
Sample220113-kdkkjagga3
SHA256 a7e00ca1925286a6d095bee734373eaf1a2683389e1071ad0ff9cc774c55976e
MD5 722d28896ba85e533591d953bf32e790
SHA1 e114d5bdec5c315fb34243be20c4b1ca571de5b7
SHA512 f574bb1978d6b46a534f7667e3724621d6c8f2c2f06a83d877816c1562e2cdb386e7a15ea34ed8280fca7e5abc716a3a5ec7fbb310d50752e4fafa9acc79fa42
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 1656	732	regsvr32.exe	27
PID 732 wrote to memory of 1656	732	regsvr32.exe	27
PID 732 wrote to memory of 1656	732	regsvr32.exe	27
PID 732 wrote to memory of 1656	732	regsvr32.exe	27
PID 732 wrote to memory of 1656	732	regsvr32.exe	27
PID 732 wrote to memory of 1656	732	regsvr32.exe	27
PID 732 wrote to memory of 1656	732	regsvr32.exe	27
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\722d28896ba85e533591d953bf32e790.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\722d28896ba85e533591d953bf32e790.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\722d28896ba85e533591d953bf32e790.dll",DllRegisterServer
    3⤵
    PID:520

memory/732-55-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/1656-57-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/1656-59-0x0000000000275000-0x0000000000276000-memory.dmp

Download

memory/1656-58-0x0000000000251000-0x0000000000275000-memory.dmp

Download