d3812d7714e2ef78ddeec78ccc9384d41dd3a36e61b2724b0da81833e750df58

Analysis

Target
9abf4d1ba2a69aa4188ced6fb4603521.dll
Size 408KB
Sample220114-mea4laffd7
SHA256 d3812d7714e2ef78ddeec78ccc9384d41dd3a36e61b2724b0da81833e750df58
MD5 9abf4d1ba2a69aa4188ced6fb4603521
SHA1 96c629d97003101dc767dea1904906f0d1d397f1
SHA512 9ff88b4eec0daa4b7872866bcb1edba459cdad54a1728ac3d2b1e16dfefd989216f6f8fb2c8612b5e5a714dccad581c41056de6122964e2535e946f86cd32e6d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9abf4d1ba2a69aa4188ced6fb4603521.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9abf4d1ba2a69aa4188ced6fb4603521.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9abf4d1ba2a69aa4188ced6fb4603521.dll",DllRegisterServer
    3⤵
    PID:472

memory/1632-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download

memory/1668-57-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1668-59-0x00000000002A5000-0x00000000002A6000-memory.dmp

Download

memory/1668-58-0x0000000000281000-0x00000000002A5000-memory.dmp

Download