94c4392e7c1dce51fb6301d788d74fa9929c48fd203bda2ab4cf95a1ba67ec16

Analysis

Target
6fb460e94924b91124d50d1a42e98ac5.dll
Size 408KB
Sample220114-lby6ksffbp
SHA256 94c4392e7c1dce51fb6301d788d74fa9929c48fd203bda2ab4cf95a1ba67ec16
MD5 6fb460e94924b91124d50d1a42e98ac5
SHA1 4d31249d6ee6d49cc1ca7d14a09759d341858767
SHA512 d1359dd91e5add9c42396f5157ab64c83722ea1d42c8b0730ba2cad13064997179c68c1363097e42c54ee9c9523ffe5ecc2b8fa47eba21230a2b73c5841baf00
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3668	3716	regsvr32.exe	68
PID 3716 wrote to memory of 3668	3716	regsvr32.exe	68
PID 3716 wrote to memory of 3668	3716	regsvr32.exe	68
PID 3668 wrote to memory of 3592	3668	regsvr32.exe	69
PID 3668 wrote to memory of 3592	3668	regsvr32.exe	69
PID 3668 wrote to memory of 3592	3668	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6fb460e94924b91124d50d1a42e98ac5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6fb460e94924b91124d50d1a42e98ac5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6fb460e94924b91124d50d1a42e98ac5.dll",DllRegisterServer
    3⤵
    PID:3592

memory/3668-117-0x0000000004C95000-0x0000000004C96000-memory.dmp

Download

memory/3668-116-0x0000000004C71000-0x0000000004C95000-memory.dmp

Download