aef282ef60b3c8a79f21da84fa958513d9854eb0f6a87b48d427aae8b099895f

Analysis

Target
4155d9cebfd7b387418e6d694b0acf36.dll
Size 408KB
Sample220114-lketasfea3
SHA256 aef282ef60b3c8a79f21da84fa958513d9854eb0f6a87b48d427aae8b099895f
MD5 4155d9cebfd7b387418e6d694b0acf36
SHA1 cfd296b2e153a16159a07d74f44c6644c7f0b16a
SHA512 12481bd8b819673f50502a775edabc3eb690218cd975546d419a48a5879af36ca7ab0d6544be012656e42baa4ca7a332abd3f18d03b650a5a557abc4c2c8dc09
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 1672	344	regsvr32.exe	68
PID 344 wrote to memory of 1672	344	regsvr32.exe	68
PID 344 wrote to memory of 1672	344	regsvr32.exe	68
PID 1672 wrote to memory of 3808	1672	regsvr32.exe	69
PID 1672 wrote to memory of 3808	1672	regsvr32.exe	69
PID 1672 wrote to memory of 3808	1672	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4155d9cebfd7b387418e6d694b0acf36.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4155d9cebfd7b387418e6d694b0acf36.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4155d9cebfd7b387418e6d694b0acf36.dll",DllRegisterServer
    3⤵
    PID:3808

memory/1672-116-0x00000000034A1000-0x00000000034C5000-memory.dmp

Download

memory/1672-117-0x00000000034C5000-0x00000000034C6000-memory.dmp

Download