aef282ef60b3c8a79f21da84fa958513d9854eb0f6a87b48d427aae8b099895f

Analysis

Target
4155d9cebfd7b387418e6d694b0acf36.dll
Size 408KB
Sample220114-lketasfea3
SHA256 aef282ef60b3c8a79f21da84fa958513d9854eb0f6a87b48d427aae8b099895f
MD5 4155d9cebfd7b387418e6d694b0acf36
SHA1 cfd296b2e153a16159a07d74f44c6644c7f0b16a
SHA512 12481bd8b819673f50502a775edabc3eb690218cd975546d419a48a5879af36ca7ab0d6544be012656e42baa4ca7a332abd3f18d03b650a5a557abc4c2c8dc09
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 876	1608	regsvr32.exe	27
PID 1608 wrote to memory of 876	1608	regsvr32.exe	27
PID 1608 wrote to memory of 876	1608	regsvr32.exe	27
PID 1608 wrote to memory of 876	1608	regsvr32.exe	27
PID 1608 wrote to memory of 876	1608	regsvr32.exe	27
PID 1608 wrote to memory of 876	1608	regsvr32.exe	27
PID 1608 wrote to memory of 876	1608	regsvr32.exe	27
PID 876 wrote to memory of 1384	876	regsvr32.exe	28
PID 876 wrote to memory of 1384	876	regsvr32.exe	28
PID 876 wrote to memory of 1384	876	regsvr32.exe	28
PID 876 wrote to memory of 1384	876	regsvr32.exe	28
PID 876 wrote to memory of 1384	876	regsvr32.exe	28
PID 876 wrote to memory of 1384	876	regsvr32.exe	28
PID 876 wrote to memory of 1384	876	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4155d9cebfd7b387418e6d694b0acf36.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4155d9cebfd7b387418e6d694b0acf36.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4155d9cebfd7b387418e6d694b0acf36.dll",DllRegisterServer
    3⤵
    PID:1384

memory/876-56-0x0000000075471000-0x0000000075473000-memory.dmp

Download

memory/876-57-0x0000000000201000-0x0000000000225000-memory.dmp

Download

memory/876-58-0x0000000000225000-0x0000000000226000-memory.dmp

Download

memory/1608-54-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Download