23050d77ca088359fb1d6c3a5b201c56a55bf5be9137a6d69bca91f5b2cafbda

Analysis

Target
142b439bbfee0b501b2c25ac46f383c4.dll
Size 408KB
Sample220114-mkzddafhep
SHA256 23050d77ca088359fb1d6c3a5b201c56a55bf5be9137a6d69bca91f5b2cafbda
MD5 142b439bbfee0b501b2c25ac46f383c4
SHA1 711a48cd51c5ff6a638913b4d4fa64ae7ae85530
SHA512 3d97e98de487345f88ff2d2d6d9791b95d7047633c24ac2c6992a3f0d13c7c90500435303f896c13cba73a516636311ba0221596427ff164797ebdf44768d5b3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2008	1924	regsvr32.exe	27
PID 1924 wrote to memory of 2008	1924	regsvr32.exe	27
PID 1924 wrote to memory of 2008	1924	regsvr32.exe	27
PID 1924 wrote to memory of 2008	1924	regsvr32.exe	27
PID 1924 wrote to memory of 2008	1924	regsvr32.exe	27
PID 1924 wrote to memory of 2008	1924	regsvr32.exe	27
PID 1924 wrote to memory of 2008	1924	regsvr32.exe	27
PID 2008 wrote to memory of 336	2008	regsvr32.exe	28
PID 2008 wrote to memory of 336	2008	regsvr32.exe	28
PID 2008 wrote to memory of 336	2008	regsvr32.exe	28
PID 2008 wrote to memory of 336	2008	regsvr32.exe	28
PID 2008 wrote to memory of 336	2008	regsvr32.exe	28
PID 2008 wrote to memory of 336	2008	regsvr32.exe	28
PID 2008 wrote to memory of 336	2008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\142b439bbfee0b501b2c25ac46f383c4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\142b439bbfee0b501b2c25ac46f383c4.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\142b439bbfee0b501b2c25ac46f383c4.dll",DllRegisterServer
    3⤵
    PID:336

memory/1924-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download

memory/2008-57-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/2008-59-0x0000000000415000-0x0000000000416000-memory.dmp

Download

memory/2008-58-0x00000000003F1000-0x0000000000415000-memory.dmp

Download