45b376d0fc17b9b709b2ccad6dc0f64c0f9eea56fccd9d311dcde2f22861bd35

Analysis

Target
39a64e119d25cf340ff0e13d68c113fc.dll
Size 408KB
Sample220114-at4y1adde7
SHA256 45b376d0fc17b9b709b2ccad6dc0f64c0f9eea56fccd9d311dcde2f22861bd35
MD5 39a64e119d25cf340ff0e13d68c113fc
SHA1 0f045977ee1e89a4bc80fbc51f5ab47ad0629f80
SHA512 e696ece6c1a51d1f934c1d9361f5844304ce358ec95d7a401ecc7e57c73ee50a68088efa1b718daf4ee4797141b82dcfd703ed0261e34167cf192bff2e7c4b62
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3724	3716	regsvr32.exe	68
PID 3716 wrote to memory of 3724	3716	regsvr32.exe	68
PID 3716 wrote to memory of 3724	3716	regsvr32.exe	68
PID 3724 wrote to memory of 996	3724	regsvr32.exe	69
PID 3724 wrote to memory of 996	3724	regsvr32.exe	69
PID 3724 wrote to memory of 996	3724	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39a64e119d25cf340ff0e13d68c113fc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\39a64e119d25cf340ff0e13d68c113fc.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\39a64e119d25cf340ff0e13d68c113fc.dll",DllRegisterServer
    3⤵
    PID:996

memory/3724-116-0x0000000000881000-0x00000000008A5000-memory.dmp

Download

memory/3724-117-0x00000000008A5000-0x00000000008A6000-memory.dmp

Download