4115d4a169359dd8d97e25a6d22f875ad509952d1da41b96e2939e31c097b24e

Analysis

Target
fffff59f935d0146ea644a0b5384dba5.dll
Size 408KB
Sample220114-cjhdcseabl
SHA256 4115d4a169359dd8d97e25a6d22f875ad509952d1da41b96e2939e31c097b24e
MD5 fffff59f935d0146ea644a0b5384dba5
SHA1 a567e225753b6fdba63172805cc43a4f3a274df3
SHA512 e17a3504907ddc49408cbf17a54316e071769ef2a6fa84d39950ef8260471e1bb5d67e7c42b63771ed501be207985d21c0c6de21763ebd7371150076e37ceaa5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1468	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1468	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1468	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1468	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1468	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1468	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1468	1308	regsvr32.exe	27
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fffff59f935d0146ea644a0b5384dba5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fffff59f935d0146ea644a0b5384dba5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fffff59f935d0146ea644a0b5384dba5.dll",DllRegisterServer
    3⤵
    PID:2036

memory/1308-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1468-56-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1468-58-0x0000000000925000-0x0000000000926000-memory.dmp

Download