a6d1ed377e3de0ae885c14ca65c2eafba01207e058ac353289182800a95b5fea

Analysis

Target
707ec8851adeff69bdb3204692c340a8.dll
Size 408KB
Sample220114-lbdvmsfdd3
SHA256 a6d1ed377e3de0ae885c14ca65c2eafba01207e058ac353289182800a95b5fea
MD5 707ec8851adeff69bdb3204692c340a8
SHA1 b51315290d9b490c55663a572bd85999f3267b7a
SHA512 fb147536a13895d60fd3fdf50507a7115a910ac6c9e7e8e36d602f5e51e8b56cec67b201003053ec5ad79cd3d342a7e62c455eef00ac067a119f7bdc6fd6ef5d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1472	1452	regsvr32.exe	27
PID 1452 wrote to memory of 1472	1452	regsvr32.exe	27
PID 1452 wrote to memory of 1472	1452	regsvr32.exe	27
PID 1452 wrote to memory of 1472	1452	regsvr32.exe	27
PID 1452 wrote to memory of 1472	1452	regsvr32.exe	27
PID 1452 wrote to memory of 1472	1452	regsvr32.exe	27
PID 1452 wrote to memory of 1472	1452	regsvr32.exe	27
PID 1472 wrote to memory of 1892	1472	regsvr32.exe	28
PID 1472 wrote to memory of 1892	1472	regsvr32.exe	28
PID 1472 wrote to memory of 1892	1472	regsvr32.exe	28
PID 1472 wrote to memory of 1892	1472	regsvr32.exe	28
PID 1472 wrote to memory of 1892	1472	regsvr32.exe	28
PID 1472 wrote to memory of 1892	1472	regsvr32.exe	28
PID 1472 wrote to memory of 1892	1472	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\707ec8851adeff69bdb3204692c340a8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\707ec8851adeff69bdb3204692c340a8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\707ec8851adeff69bdb3204692c340a8.dll",DllRegisterServer
    3⤵
    PID:1892

memory/1452-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download

memory/1472-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1472-57-0x0000000000531000-0x0000000000555000-memory.dmp

Download

memory/1472-58-0x0000000000555000-0x0000000000556000-memory.dmp

Download