408e24e34e423d0ee843ee6b153b804765896348e8a046d9aae7b899b3194fb8

Analysis

Target
5b1f5dfeb1d63dfad1961f11a1d13ccd.dll
Size 408KB
Sample220114-lbdvmsffar
SHA256 408e24e34e423d0ee843ee6b153b804765896348e8a046d9aae7b899b3194fb8
MD5 5b1f5dfeb1d63dfad1961f11a1d13ccd
SHA1 140fae6f1e530e994b73b5ccf3d8343aa2c3e94b
SHA512 63a1b92e00304a14876c2875f252777f88cba5a8151cb7ac87240556fea42f9517e5fa5ef33df2b963c1b1556e08744b53fb98c5c542cbb3a95dec81db1e2230
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1796	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1796	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1796	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1796	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1796	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1796	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1796	1928	regsvr32.exe	27
PID 1796 wrote to memory of 792	1796	regsvr32.exe	28
PID 1796 wrote to memory of 792	1796	regsvr32.exe	28
PID 1796 wrote to memory of 792	1796	regsvr32.exe	28
PID 1796 wrote to memory of 792	1796	regsvr32.exe	28
PID 1796 wrote to memory of 792	1796	regsvr32.exe	28
PID 1796 wrote to memory of 792	1796	regsvr32.exe	28
PID 1796 wrote to memory of 792	1796	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5b1f5dfeb1d63dfad1961f11a1d13ccd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5b1f5dfeb1d63dfad1961f11a1d13ccd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5b1f5dfeb1d63dfad1961f11a1d13ccd.dll",DllRegisterServer
    3⤵
    PID:792

memory/1796-57-0x0000000076511000-0x0000000076513000-memory.dmp

Download

memory/1796-59-0x0000000000305000-0x0000000000306000-memory.dmp

Download

memory/1796-58-0x00000000002E1000-0x0000000000305000-memory.dmp

Download

memory/1928-55-0x000007FEFC151000-0x000007FEFC153000-memory.dmp

Download