d3812d7714e2ef78ddeec78ccc9384d41dd3a36e61b2724b0da81833e750df58

Analysis

Target
9abf4d1ba2a69aa4188ced6fb4603521.dll
Size 408KB
Sample220114-mea4laffd7
SHA256 d3812d7714e2ef78ddeec78ccc9384d41dd3a36e61b2724b0da81833e750df58
MD5 9abf4d1ba2a69aa4188ced6fb4603521
SHA1 96c629d97003101dc767dea1904906f0d1d397f1
SHA512 9ff88b4eec0daa4b7872866bcb1edba459cdad54a1728ac3d2b1e16dfefd989216f6f8fb2c8612b5e5a714dccad581c41056de6122964e2535e946f86cd32e6d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3680	2700	regsvr32.exe	68
PID 2700 wrote to memory of 3680	2700	regsvr32.exe	68
PID 2700 wrote to memory of 3680	2700	regsvr32.exe	68
PID 3680 wrote to memory of 2608	3680	regsvr32.exe	69
PID 3680 wrote to memory of 2608	3680	regsvr32.exe	69
PID 3680 wrote to memory of 2608	3680	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9abf4d1ba2a69aa4188ced6fb4603521.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9abf4d1ba2a69aa4188ced6fb4603521.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9abf4d1ba2a69aa4188ced6fb4603521.dll",DllRegisterServer
    3⤵
    PID:2608

memory/3680-115-0x00000000042D1000-0x00000000042F5000-memory.dmp

Download

memory/3680-116-0x00000000042F5000-0x00000000042F6000-memory.dmp

Download