961fa4d4d64a759115080d79efd12ff08ef3d05eb69edb300421d4a6a8541b10

Analysis

Target
5a8e7fdcc3cde8345f77c2a711b0ac7c.dll
Size 1.4MB
Sample220113-z3dwlscefm
SHA256 961fa4d4d64a759115080d79efd12ff08ef3d05eb69edb300421d4a6a8541b10
MD5 5a8e7fdcc3cde8345f77c2a711b0ac7c
SHA1 6f70ddef8f589de686039d63ff0d19b2b45e1225
SHA512 3c465d6f25b948a9472c2ca22e53afc313842b78d8cc1e9b99494313c405454e11a9bc6b30c83f64693e8bf899c7075b51482d8aaae11cd1dcd5f754aca624d8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2680	2652	regsvr32.exe	68
PID 2652 wrote to memory of 2680	2652	regsvr32.exe	68
PID 2652 wrote to memory of 2680	2652	regsvr32.exe	68
PID 2680 wrote to memory of 3140	2680	regsvr32.exe	69
PID 2680 wrote to memory of 3140	2680	regsvr32.exe	69
PID 2680 wrote to memory of 3140	2680	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5a8e7fdcc3cde8345f77c2a711b0ac7c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5a8e7fdcc3cde8345f77c2a711b0ac7c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5a8e7fdcc3cde8345f77c2a711b0ac7c.dll",DllRegisterServer
    3⤵
    PID:3140

memory/2680-116-0x0000000000670000-0x0000000000698000-memory.dmp

Download