ca55eb510c8ff933c4e1c727baa615842eba997e887e99705898a6777a960a53

Analysis

Target
7hEJ0mygY3qgDZz.dll
Size 408KB
Sample220114-q5c8esgec8
SHA256 ca55eb510c8ff933c4e1c727baa615842eba997e887e99705898a6777a960a53
MD5 d565837b291dcb475bd88fb1f6a7fd3a
SHA1 f74e4cdb2d9865044c5b3db5491af1d4f8563177
SHA512 c283256aa15833764888b303a21138b2d9d5b166372301b8d6e3882adfe6f452707d27ce29f1b1d6852babf394956086253cf6859ccc7c18156941003aa3d222
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1120	1052	regsvr32.exe	69
PID 1052 wrote to memory of 1120	1052	regsvr32.exe	69
PID 1052 wrote to memory of 1120	1052	regsvr32.exe	69
PID 1120 wrote to memory of 3320	1120	regsvr32.exe	70
PID 1120 wrote to memory of 3320	1120	regsvr32.exe	70
PID 1120 wrote to memory of 3320	1120	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7hEJ0mygY3qgDZz.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7hEJ0mygY3qgDZz.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7hEJ0mygY3qgDZz.dll",DllRegisterServer
    3⤵
    PID:3320

memory/1120-117-0x0000000002705000-0x0000000002706000-memory.dmp

Download

memory/1120-116-0x00000000026E1000-0x0000000002705000-memory.dmp

Download