23050d77ca088359fb1d6c3a5b201c56a55bf5be9137a6d69bca91f5b2cafbda

Analysis

Target
142b439bbfee0b501b2c25ac46f383c4.dll
Size 408KB
Sample220114-mkzddafhep
SHA256 23050d77ca088359fb1d6c3a5b201c56a55bf5be9137a6d69bca91f5b2cafbda
MD5 142b439bbfee0b501b2c25ac46f383c4
SHA1 711a48cd51c5ff6a638913b4d4fa64ae7ae85530
SHA512 3d97e98de487345f88ff2d2d6d9791b95d7047633c24ac2c6992a3f0d13c7c90500435303f896c13cba73a516636311ba0221596427ff164797ebdf44768d5b3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	68
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	68
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	68
PID 2736 wrote to memory of 3812	2736	regsvr32.exe	69
PID 2736 wrote to memory of 3812	2736	regsvr32.exe	69
PID 2736 wrote to memory of 3812	2736	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\142b439bbfee0b501b2c25ac46f383c4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\142b439bbfee0b501b2c25ac46f383c4.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\142b439bbfee0b501b2c25ac46f383c4.dll",DllRegisterServer
    3⤵
    PID:3812

memory/2736-116-0x0000000003381000-0x00000000033A5000-memory.dmp

Download

memory/2736-117-0x00000000033A5000-0x00000000033A6000-memory.dmp

Download