a7e00ca1925286a6d095bee734373eaf1a2683389e1071ad0ff9cc774c55976e

Analysis

Target
722d28896ba85e533591d953bf32e790.dll
Size 736KB
Sample220113-kdkkjagga3
SHA256 a7e00ca1925286a6d095bee734373eaf1a2683389e1071ad0ff9cc774c55976e
MD5 722d28896ba85e533591d953bf32e790
SHA1 e114d5bdec5c315fb34243be20c4b1ca571de5b7
SHA512 f574bb1978d6b46a534f7667e3724621d6c8f2c2f06a83d877816c1562e2cdb386e7a15ea34ed8280fca7e5abc716a3a5ec7fbb310d50752e4fafa9acc79fa42
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2504	2336	regsvr32.exe	68
PID 2336 wrote to memory of 2504	2336	regsvr32.exe	68
PID 2336 wrote to memory of 2504	2336	regsvr32.exe	68
PID 2504 wrote to memory of 2760	2504	regsvr32.exe	69
PID 2504 wrote to memory of 2760	2504	regsvr32.exe	69
PID 2504 wrote to memory of 2760	2504	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\722d28896ba85e533591d953bf32e790.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\722d28896ba85e533591d953bf32e790.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\722d28896ba85e533591d953bf32e790.dll",DllRegisterServer
    3⤵
    PID:2760

memory/2504-119-0x0000000000DA1000-0x0000000000DC5000-memory.dmp

Download

memory/2504-120-0x0000000000DC5000-0x0000000000DC6000-memory.dmp

Download