4115d4a169359dd8d97e25a6d22f875ad509952d1da41b96e2939e31c097b24e

Analysis

Target
fffff59f935d0146ea644a0b5384dba5.dll
Size 408KB
Sample220114-cjhdcseabl
SHA256 4115d4a169359dd8d97e25a6d22f875ad509952d1da41b96e2939e31c097b24e
MD5 fffff59f935d0146ea644a0b5384dba5
SHA1 a567e225753b6fdba63172805cc43a4f3a274df3
SHA512 e17a3504907ddc49408cbf17a54316e071769ef2a6fa84d39950ef8260471e1bb5d67e7c42b63771ed501be207985d21c0c6de21763ebd7371150076e37ceaa5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3868	3980	regsvr32.exe	68
PID 3980 wrote to memory of 3868	3980	regsvr32.exe	68
PID 3980 wrote to memory of 3868	3980	regsvr32.exe	68
PID 3868 wrote to memory of 3852	3868	regsvr32.exe	69
PID 3868 wrote to memory of 3852	3868	regsvr32.exe	69
PID 3868 wrote to memory of 3852	3868	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fffff59f935d0146ea644a0b5384dba5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fffff59f935d0146ea644a0b5384dba5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fffff59f935d0146ea644a0b5384dba5.dll",DllRegisterServer
    3⤵
    PID:3852

memory/3868-117-0x0000000001305000-0x0000000001306000-memory.dmp

Download

memory/3868-116-0x00000000012E1000-0x0000000001305000-memory.dmp

Download