ca55eb510c8ff933c4e1c727baa615842eba997e887e99705898a6777a960a53

Analysis

Target
7hEJ0mygY3qgDZz.dll
Size 408KB
Sample220114-q5c8esgec8
SHA256 ca55eb510c8ff933c4e1c727baa615842eba997e887e99705898a6777a960a53
MD5 d565837b291dcb475bd88fb1f6a7fd3a
SHA1 f74e4cdb2d9865044c5b3db5491af1d4f8563177
SHA512 c283256aa15833764888b303a21138b2d9d5b166372301b8d6e3882adfe6f452707d27ce29f1b1d6852babf394956086253cf6859ccc7c18156941003aa3d222
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 1096	528	regsvr32.exe	27
PID 528 wrote to memory of 1096	528	regsvr32.exe	27
PID 528 wrote to memory of 1096	528	regsvr32.exe	27
PID 528 wrote to memory of 1096	528	regsvr32.exe	27
PID 528 wrote to memory of 1096	528	regsvr32.exe	27
PID 528 wrote to memory of 1096	528	regsvr32.exe	27
PID 528 wrote to memory of 1096	528	regsvr32.exe	27
PID 1096 wrote to memory of 564	1096	regsvr32.exe	28
PID 1096 wrote to memory of 564	1096	regsvr32.exe	28
PID 1096 wrote to memory of 564	1096	regsvr32.exe	28
PID 1096 wrote to memory of 564	1096	regsvr32.exe	28
PID 1096 wrote to memory of 564	1096	regsvr32.exe	28
PID 1096 wrote to memory of 564	1096	regsvr32.exe	28
PID 1096 wrote to memory of 564	1096	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7hEJ0mygY3qgDZz.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7hEJ0mygY3qgDZz.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7hEJ0mygY3qgDZz.dll",DllRegisterServer
    3⤵
    PID:564

memory/528-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download

memory/1096-56-0x0000000076121000-0x0000000076123000-memory.dmp

Download

memory/1096-58-0x0000000000215000-0x0000000000216000-memory.dmp

Download