50860da06147ec56df91d2f10fd66d9d0d462d544bd4e4b5e805f4c3308ed132

Analysis

Target
ygqtFS.dll
Size 736KB
Sample220113-rt9ypaahfm
SHA256 50860da06147ec56df91d2f10fd66d9d0d462d544bd4e4b5e805f4c3308ed132
MD5 1ad3a1d95f68f10a29e585f2f1ae02c5
SHA1 14faff48b7998a723bb13204fe0ed332429e7eac
SHA512 52072d73515c99ecc81b225762e083e2c60dd6a4be289552c68a84b854eb62279603ef12b6da8b6eb54aac1b198996647d8342f6808d92952299845ebf786d01
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1156	952	regsvr32.exe	27
PID 952 wrote to memory of 1156	952	regsvr32.exe	27
PID 952 wrote to memory of 1156	952	regsvr32.exe	27
PID 952 wrote to memory of 1156	952	regsvr32.exe	27
PID 952 wrote to memory of 1156	952	regsvr32.exe	27
PID 952 wrote to memory of 1156	952	regsvr32.exe	27
PID 952 wrote to memory of 1156	952	regsvr32.exe	27
PID 1156 wrote to memory of 760	1156	regsvr32.exe	28
PID 1156 wrote to memory of 760	1156	regsvr32.exe	28
PID 1156 wrote to memory of 760	1156	regsvr32.exe	28
PID 1156 wrote to memory of 760	1156	regsvr32.exe	28
PID 1156 wrote to memory of 760	1156	regsvr32.exe	28
PID 1156 wrote to memory of 760	1156	regsvr32.exe	28
PID 1156 wrote to memory of 760	1156	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ygqtFS.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ygqtFS.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ygqtFS.dll",DllRegisterServer
    3⤵
    PID:760

memory/952-53-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download

memory/1156-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1156-57-0x0000000000255000-0x0000000000256000-memory.dmp

Download

memory/1156-56-0x0000000000231000-0x0000000000255000-memory.dmp

Download