a6d1ed377e3de0ae885c14ca65c2eafba01207e058ac353289182800a95b5fea

Analysis

Target
707ec8851adeff69bdb3204692c340a8.dll
Size 408KB
Sample220114-lbdvmsfdd3
SHA256 a6d1ed377e3de0ae885c14ca65c2eafba01207e058ac353289182800a95b5fea
MD5 707ec8851adeff69bdb3204692c340a8
SHA1 b51315290d9b490c55663a572bd85999f3267b7a
SHA512 fb147536a13895d60fd3fdf50507a7115a910ac6c9e7e8e36d602f5e51e8b56cec67b201003053ec5ad79cd3d342a7e62c455eef00ac067a119f7bdc6fd6ef5d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2504	2340	regsvr32.exe	68
PID 2340 wrote to memory of 2504	2340	regsvr32.exe	68
PID 2340 wrote to memory of 2504	2340	regsvr32.exe	68
PID 2504 wrote to memory of 2756	2504	regsvr32.exe	69
PID 2504 wrote to memory of 2756	2504	regsvr32.exe	69
PID 2504 wrote to memory of 2756	2504	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\707ec8851adeff69bdb3204692c340a8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\707ec8851adeff69bdb3204692c340a8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\707ec8851adeff69bdb3204692c340a8.dll",DllRegisterServer
    3⤵
    PID:2756

memory/2504-117-0x0000000002DB5000-0x0000000002DB6000-memory.dmp

Download

memory/2504-116-0x0000000002D91000-0x0000000002DB5000-memory.dmp

Download