408e24e34e423d0ee843ee6b153b804765896348e8a046d9aae7b899b3194fb8

Analysis

Target
5b1f5dfeb1d63dfad1961f11a1d13ccd.dll
Size 408KB
Sample220114-lbdvmsffar
SHA256 408e24e34e423d0ee843ee6b153b804765896348e8a046d9aae7b899b3194fb8
MD5 5b1f5dfeb1d63dfad1961f11a1d13ccd
SHA1 140fae6f1e530e994b73b5ccf3d8343aa2c3e94b
SHA512 63a1b92e00304a14876c2875f252777f88cba5a8151cb7ac87240556fea42f9517e5fa5ef33df2b963c1b1556e08744b53fb98c5c542cbb3a95dec81db1e2230
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3412	1672	regsvr32.exe	68
PID 1672 wrote to memory of 3412	1672	regsvr32.exe	68
PID 1672 wrote to memory of 3412	1672	regsvr32.exe	68
PID 3412 wrote to memory of 3544	3412	regsvr32.exe	69
PID 3412 wrote to memory of 3544	3412	regsvr32.exe	69
PID 3412 wrote to memory of 3544	3412	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5b1f5dfeb1d63dfad1961f11a1d13ccd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5b1f5dfeb1d63dfad1961f11a1d13ccd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5b1f5dfeb1d63dfad1961f11a1d13ccd.dll",DllRegisterServer
    3⤵
    PID:3544

memory/3412-117-0x0000000000AA5000-0x0000000000AA6000-memory.dmp

Download